# DNS spyware rules by Jack Pepper ( pepperjack@autoshun.org )
# regenerated daily from the domains.txt file at David Glosser's Black hole DNs project
# The URL for BHDNS project:  http://www.malwaredomains.com/files/domains.txt
# The source URL for this   http://www.autoshun.org/downloads/bhdns.rules
#
# A hit on one of these rules indicates is that the dumass user clicked 
# on something shiny, or has spyware installed, or visited a site that 
# tried to do a driveby install.
# 
# Fri, 03 Feb 2012 02:12:24 -0600 
# Error on # domains list from bhdns
# Error on # Defective domain declaration: ##	 If you do not accept these term then do not use this information.
# Error on # Defective domain declaration: ##	For noncommercial use only. Using this information indicates you agree to be bound by these terms.
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arena-eg.com IMMORTAL (Malware_Distribution)"; content:"|08|arena-eg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fzdqjn.cn IMMORTAL (Malware_Distribution)"; content:"|06|fzdqjn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpartyworld.com IMMORTAL (Malware_Distribution)"; content:"|0d|newpartyworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enlaceseducativos.com.ar IMMORTAL (Malware_Distribution)"; content:"|11|enlaceseducativos|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixeajki.cn IMMORTAL (Malware_Distribution)"; content:"|07|ixeajki|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nkphcoop.com IMMORTAL (Malware_Distribution)"; content:"|08|nkphcoop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reflexoterapiemasaj-vacuum.ro IMMORTAL (Malware_Distribution)"; content:"|1a|reflexoterapiemasaj-vacuum|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theonscreen.com IMMORTAL (Malware_Distribution)"; content:"|0b|theonscreen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topbusinesscoaches.com IMMORTAL (Malware_Distribution)"; content:"|12|topbusinesscoaches|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vitrineoeste.com.br IMMORTAL (Malware_Distribution)"; content:"|0c|vitrineoeste|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwsarkozy.eu IMMORTAL (Malware_Distribution)"; content:"|0a|wwwsarkozy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--iimizmzik-v9a79h.com IMMORTAL (Malware_Distribution)"; content:"|14|xn--iimizmzik-v9a79h|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rcturbo.com IMMORTAL (Malware_Distribution)"; content:"|07|rcturbo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regalachiefs.com IMMORTAL (Malware_Distribution)"; content:"|0c|regalachiefs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matzines.com IMMORTAL (Malware_Distribution)"; content:"|08|matzines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qsfgyee.com IMMORTAL (Malware_Distribution)"; content:"|07|qsfgyee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elcombra.de IMMORTAL (Malware_Distribution)"; content:"|08|elcombra|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 75oal.k12.tr IMMORTAL (Malware_Distribution)"; content:"|05|75oal|03|k12|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup angelesrodriguez.com.ar IMMORTAL (Malware_Distribution)"; content:"|10|angelesrodriguez|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anywayitsolutions.com IMMORTAL (Malware_Distribution)"; content:"|11|anywayitsolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apysvirtual.com.ar IMMORTAL (Malware_Distribution)"; content:"|0b|apysvirtual|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ascomaformation.info IMMORTAL (Malware_Distribution)"; content:"|0f|ascomaformation|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autohton2005.ro IMMORTAL (Malware_Distribution)"; content:"|0c|autohton2005|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azadtravels.co.uk IMMORTAL (Malware_Distribution)"; content:"|0b|azadtravels|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfinderr.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bestfinderr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitaid.nl IMMORTAL (Malware_Distribution)"; content:"|06|bitaid|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carita.pl IMMORTAL (Malware_Distribution)"; content:"|06|carita|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centrepassatge.com IMMORTAL (Malware_Distribution)"; content:"|0e|centrepassatge|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citygroupservices.com IMMORTAL (Malware_Distribution)"; content:"|11|citygroupservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coll-med6.freevar.com IMMORTAL (Malware_Distribution)"; content:"|09|coll-med6|07|freevar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darkscape.info IMMORTAL (Malware_Distribution)"; content:"|09|darkscape|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup denhollander.cc IMMORTAL (Malware_Distribution)"; content:"|0c|denhollander|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup devision-sharks.ru IMMORTAL (Malware_Distribution)"; content:"|0f|devision-sharks|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doitbig.org IMMORTAL (Malware_Distribution)"; content:"|07|doitbig|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emugyk.cn IMMORTAL (Malware_Distribution)"; content:"|06|emugyk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup equipeworldsound.com.br IMMORTAL (Malware_Distribution)"; content:"|10|equipeworldsound|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup escuela60guatrache.com.ar IMMORTAL (Malware_Distribution)"; content:"|12|escuela60guatrache|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gpkangra.com IMMORTAL (Malware_Distribution)"; content:"|08|gpkangra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igraemvpingpong.ru IMMORTAL (Malware_Distribution)"; content:"|0f|igraemvpingpong|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isshl.com IMMORTAL (Malware_Distribution)"; content:"|05|isshl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kapaone.org IMMORTAL (Malware_Distribution)"; content:"|07|kapaone|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup konmuangdong.com IMMORTAL (Malware_Distribution)"; content:"|0c|konmuangdong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moatarian.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|09|moatarian|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moblehasehmi.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|0c|moblehasehmi|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radarodz300.com IMMORTAL (Malware_Distribution)"; content:"|0b|radarodz300|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smileidea.com IMMORTAL (Malware_Distribution)"; content:"|09|smileidea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strategiccapitalalliance.com IMMORTAL (Malware_Distribution)"; content:"|18|strategiccapitalalliance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup today-newday.cn IMMORTAL (Malware_Distribution)"; content:"|0c|today-newday|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casio-hodinky.com IMMORTAL (Malware_Distribution)"; content:"|0d|casio-hodinky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5g.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bayram-197.com IMMORTAL (Malware_Distribution)"; content:"|0a|bayram-197|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotoris.com IMMORTAL (Malware_Distribution)"; content:"|07|fotoris|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gclub1688.net IMMORTAL (Malware_Distribution)"; content:"|09|gclub1688|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsccleveland.com IMMORTAL (Malware_Distribution)"; content:"|0c|gsccleveland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haggar.cl IMMORTAL (Malware_Distribution)"; content:"|06|haggar|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idamusti.dk IMMORTAL (Malware_Distribution)"; content:"|08|idamusti|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jubailcityplanning.com IMMORTAL (Malware_Distribution)"; content:"|12|jubailcityplanning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limosforhenparties.co.uk IMMORTAL (Malware_Distribution)"; content:"|12|limosforhenparties|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup repair.ivyro.net IMMORTAL (Malware_Distribution)"; content:"|06|repair|05|ivyro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sagri.org IMMORTAL (Malware_Distribution)"; content:"|05|sagri|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salinasenterprise.com IMMORTAL (Malware_Distribution)"; content:"|11|salinasenterprise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fopsl.cn IMMORTAL (Malware_Infectors)"; content:"|05|fopsl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adsnet.biz IMMORTAL (Malware_Distribution)"; content:"|06|adsnet|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directbinary.com IMMORTAL (Malware_Distribution)"; content:"|0c|directbinary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fd1a234sa.com IMMORTAL (Malware_Distribution)"; content:"|09|fd1a234sa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freead.name IMMORTAL (Malware_Distribution)"; content:"|06|freead|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuchroot.com IMMORTAL (Malware_Distribution)"; content:"|08|fuchroot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilui45iu7.com IMMORTAL (Malware_Distribution)"; content:"|09|ilui45iu7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkfjfuisdh.com IMMORTAL (Malware_Distribution)"; content:"|0a|lkfjfuisdh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tottaldomain.cn IMMORTAL (Malware_Distribution)"; content:"|0c|tottaldomain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wdggtwegww.com IMMORTAL (Malware_Distribution)"; content:"|0a|wdggtwegww|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d99q.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|04|d99q|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eracou.com IMMORTAL (Malware_Distribution)"; content:"|06|eracou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup correndo.se IMMORTAL (Malware_Distribution)"; content:"|08|correndo|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup most-mammals.com IMMORTAL (Malware_Distribution)"; content:"|0c|most-mammals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paramworld.com IMMORTAL (Malware_Distribution)"; content:"|0a|paramworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rts-me.com IMMORTAL (Malware_Distribution)"; content:"|06|rts-me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smallcap360.com IMMORTAL (Malware_Distribution)"; content:"|0b|smallcap360|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotnuded.info IMMORTAL (Malware_Distribution)"; content:"|08|hotnuded|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macromediasetup.com IMMORTAL (Malware_Infectors)"; content:"|0f|macromediasetup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 372kzsds7661.com IMMORTAL (Malware_Distribution)"; content:"|0c|372kzsds7661|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a2construction.net IMMORTAL (Malware_Distribution)"; content:"|0e|a2construction|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agalp.ro IMMORTAL (Malware_Distribution)"; content:"|05|agalp|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agropharma.com.ar IMMORTAL (Malware_Distribution)"; content:"|0a|agropharma|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aidaris.zc.bz IMMORTAL (Malware_Distribution)"; content:"|07|aidaris|02|zc|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almightybusiness.co.in IMMORTAL (Malware_Distribution)"; content:"|10|almightybusiness|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apogeecleaning.com IMMORTAL (Malware_Distribution)"; content:"|0e|apogeecleaning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arak.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|04|arak|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baeisa.co.cc IMMORTAL (Malware_Distribution)"; content:"|06|baeisa|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baidustatz.com IMMORTAL (Malware_Distribution)"; content:"|0a|baidustatz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bb4msg.com IMMORTAL (Malware_Distribution)"; content:"|06|bb4msg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bliman.com IMMORTAL (Malware_Distribution)"; content:"|06|bliman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brookewhitemedia.com IMMORTAL (Malware_Distribution)"; content:"|10|brookewhitemedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cavaliersales.com IMMORTAL (Malware_Distribution)"; content:"|0d|cavaliersales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup classicgamingcruises.com IMMORTAL (Malware_Distribution)"; content:"|14|classicgamingcruises|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup club-fx.ru IMMORTAL (Malware_Distribution)"; content:"|07|club-fx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeguard.biz IMMORTAL (Malware_Distribution)"; content:"|09|freeguard|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabiweb.com IMMORTAL (Malware_Distribution)"; content:"|07|gabiweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analyze.org IMMORTAL (Malware_Distribution)"; content:"|0e|google-analyze|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-newbot.cn IMMORTAL (Malware_Distribution)"; content:"|0d|google-newbot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horasan.bel.tr IMMORTAL (Malware_Distribution)"; content:"|07|horasan|03|bel|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imapkolkata.com IMMORTAL (Malware_Distribution)"; content:"|0b|imapkolkata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lisac2009.info IMMORTAL (Malware_Distribution)"; content:"|09|lisac2009|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup money2008.org IMMORTAL (Malware_Distribution)"; content:"|09|money2008|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicmufta.com IMMORTAL (Malware_Distribution)"; content:"|0a|musicmufta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naijapress.com IMMORTAL (Malware_Distribution)"; content:"|0a|naijapress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newtransfer.cn IMMORTAL (Malware_Distribution)"; content:"|0b|newtransfer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinedetect.com IMMORTAL (Malware_Distribution)"; content:"|0c|onlinedetect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup our-children.net IMMORTAL (Malware_Distribution)"; content:"|0c|our-children|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plustecpk.com IMMORTAL (Malware_Distribution)"; content:"|09|plustecpk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rattanaburihos.com IMMORTAL (Malware_Distribution)"; content:"|0e|rattanaburihos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rockdog.ru IMMORTAL (Malware_Distribution)"; content:"|07|rockdog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s216344386.online.de IMMORTAL (Malware_Distribution)"; content:"|0a|s216344386|06|online|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sp.sk IMMORTAL (Malware_Distribution)"; content:"|02|sp|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sragenlor.com IMMORTAL (Malware_Distribution)"; content:"|09|sragenlor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vyshnya.pp.ua IMMORTAL (Malware_Distribution)"; content:"|07|vyshnya|02|pp|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yescounter.com IMMORTAL (Malware_Distribution)"; content:"|0a|yescounter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2roonoodle.net IMMORTAL (Malware_Distribution)"; content:"|0a|2roonoodle|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigbossindia.net IMMORTAL (Malware_Distribution)"; content:"|0c|bigbossindia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnnomers.com IMMORTAL (Malware_Distribution)"; content:"|08|cnnomers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dennisvalentine.com IMMORTAL (Malware_Distribution)"; content:"|0f|dennisvalentine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuskerbytes.com IMMORTAL (Malware_Distribution)"; content:"|0b|fuskerbytes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intermaterials.net IMMORTAL (Malware_Distribution)"; content:"|0e|intermaterials|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minpoo.com IMMORTAL (Malware_Distribution)"; content:"|06|minpoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stripsen.dk IMMORTAL (Malware_Distribution)"; content:"|08|stripsen|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geniewebtest.co.uk IMMORTAL (Malware_Infectors)"; content:"|0c|geniewebtest|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betheo.com IMMORTAL (Malware_Distribution)"; content:"|06|betheo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hama-soft.com IMMORTAL (Malware_Distribution)"; content:"|09|hama-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awmmagazine.ru IMMORTAL (Malware_Distribution)"; content:"|0b|awmmagazine|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtjhteyjtyjtyj.orge.pl IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0e|rtjhteyjtyjtyj|04|orge|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 888758.com IMMORTAL (Fake_AV)"; content:"|06|888758|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-cipher.com IMMORTAL (Malware_Distribution)"; content:"|08|a-cipher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booblegum5.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|booblegum5|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yaruluytut.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|yaruluytut|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup entertainments-mp3-online.com IMMORTAL (Malware_Distribution)"; content:"|19|entertainments-mp3-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grillonet.com.br IMMORTAL (Malware_Distribution)"; content:"|09|grillonet|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vemmanederland.nl IMMORTAL (Malware_Distribution)"; content:"|0e|vemmanederland|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yalovasehri.com IMMORTAL (Malware_Distribution)"; content:"|0b|yalovasehri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup talkio.com IMMORTAL (Malware_Infectors)"; content:"|06|talkio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumentha.com IMMORTAL (SEO_Fraud)"; content:"|08|gumentha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avinashdeoskar.com IMMORTAL (Malware_Infectors)"; content:"|0e|avinashdeoskar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ladenas938.com IMMORTAL (Malware_Infectors)"; content:"|0a|ladenas938|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mfradio.lx.ro IMMORTAL (Malware_Infectors)"; content:"|07|mfradio|02|lx|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mustafahorasan.com IMMORTAL (Malware_Infectors)"; content:"|0e|mustafahorasan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunsetstampede.org IMMORTAL (Malware_Infectors)"; content:"|0e|sunsetstampede|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup werbnjudr.co.cc IMMORTAL (Malware_Infectors)"; content:"|09|werbnjudr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gmp32.org IMMORTAL (Malware_Distribution)"; content:"|05|gmp32|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n-age.net IMMORTAL (Malware_Distribution)"; content:"|05|n-age|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piast-poland.com IMMORTAL (Malware_Distribution)"; content:"|0c|piast-poland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotel-sas.ru IMMORTAL (Malware_Distribution)"; content:"|09|hotel-sas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferhatkaraca.com IMMORTAL (Malware_Distribution)"; content:"|0c|ferhatkaraca|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackjackcardcounting.co.uk IMMORTAL (Malware_Distribution)"; content:"|15|blackjackcardcounting|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addthiss.net IMMORTAL (Malware_Distribution)"; content:"|08|addthiss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agasi-story.info IMMORTAL (Malware_Distribution)"; content:"|0b|agasi-story|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akyoma.com IMMORTAL (Malware_Distribution)"; content:"|06|akyoma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup areasdm.com.ar IMMORTAL (Malware_Distribution)"; content:"|07|areasdm|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beza.tu2.ru IMMORTAL (Malware_Distribution)"; content:"|04|beza|03|tu2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmplaces.msk.ru IMMORTAL (Malware_Distribution)"; content:"|08|bmplaces|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carlossalina.com.ar IMMORTAL (Malware_Distribution)"; content:"|0c|carlossalina|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cipayroll.com IMMORTAL (Malware_Distribution)"; content:"|09|cipayroll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coiffure-claude.com IMMORTAL (Malware_Distribution)"; content:"|0f|coiffure-claude|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosmoabc.com IMMORTAL (Malware_Distribution)"; content:"|08|cosmoabc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dailylaiken.com IMMORTAL (Malware_Distribution)"; content:"|0b|dailylaiken|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup damisystem.com IMMORTAL (Malware_Distribution)"; content:"|0a|damisystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup escorialescorial.com IMMORTAL (Malware_Distribution)"; content:"|10|escorialescorial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fajowe.ovh.org IMMORTAL (Malware_Distribution)"; content:"|06|fajowe|03|ovh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fauxtastic.net IMMORTAL (Malware_Distribution)"; content:"|0a|fauxtastic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ff-traditions.com IMMORTAL (Malware_Distribution)"; content:"|0d|ff-traditions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fnyoga.biz IMMORTAL (Malware_Distribution)"; content:"|06|fnyoga|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foto-retuse.cz IMMORTAL (Malware_Distribution)"; content:"|0b|foto-retuse|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotoris.co.kr IMMORTAL (Malware_Distribution)"; content:"|07|fotoris|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-birthday-party.com IMMORTAL (Malware_Distribution)"; content:"|13|free-birthday-party|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gnci-ict.com IMMORTAL (Malware_Distribution)"; content:"|08|gnci-ict|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gozites.com IMMORTAL (Malware_Distribution)"; content:"|07|gozites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huileargane.com IMMORTAL (Malware_Distribution)"; content:"|0b|huileargane|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup invincible72.com IMMORTAL (Malware_Distribution)"; content:"|0c|invincible72|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaplanoyunaletleri.com IMMORTAL (Malware_Distribution)"; content:"|12|kaplanoyunaletleri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lupitaarmas.com IMMORTAL (Malware_Distribution)"; content:"|0b|lupitaarmas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medyasehir.com IMMORTAL (Malware_Distribution)"; content:"|0a|medyasehir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mitroc.com IMMORTAL (Malware_Distribution)"; content:"|06|mitroc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mukertvaros.hu IMMORTAL (Malware_Distribution)"; content:"|0b|mukertvaros|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nakoncu.superhost.pl IMMORTAL (Malware_Distribution)"; content:"|07|nakoncu|09|superhost|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newufuq.com IMMORTAL (Malware_Distribution)"; content:"|07|newufuq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextgenengineer.org IMMORTAL (Malware_Distribution)"; content:"|0f|nextgenengineer|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obtkayukhlak.com IMMORTAL (Malware_Distribution)"; content:"|0c|obtkayukhlak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oxnard.la IMMORTAL (Malware_Distribution)"; content:"|06|oxnard|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oxxxi.com IMMORTAL (Malware_Distribution)"; content:"|05|oxxxi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oyunzadem.com IMMORTAL (Malware_Distribution)"; content:"|09|oyunzadem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ozguvenplastik.com IMMORTAL (Malware_Distribution)"; content:"|0e|ozguvenplastik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pakptc.com IMMORTAL (Malware_Distribution)"; content:"|06|pakptc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup posgame.com IMMORTAL (Malware_Distribution)"; content:"|07|posgame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup projectland.co.kr IMMORTAL (Malware_Distribution)"; content:"|0b|projectland|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psplanet.com.au IMMORTAL (Malware_Distribution)"; content:"|08|psplanet|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puppetpalace.nl IMMORTAL (Malware_Distribution)"; content:"|0c|puppetpalace|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qddlbd.com IMMORTAL (Malware_Distribution)"; content:"|06|qddlbd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rks1.de IMMORTAL (Malware_Distribution)"; content:"|04|rks1|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxgenerics.net IMMORTAL (Malware_Distribution)"; content:"|0a|rxgenerics|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sarvodayachildcare.com IMMORTAL (Malware_Distribution)"; content:"|12|sarvodayachildcare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoremill.com IMMORTAL (Malware_Distribution)"; content:"|09|shoremill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup showkurve.de IMMORTAL (Malware_Distribution)"; content:"|09|showkurve|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shreeramrealestate.com IMMORTAL (Malware_Distribution)"; content:"|12|shreeramrealestate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sinsaengtech.com IMMORTAL (Malware_Distribution)"; content:"|0c|sinsaengtech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sis-street.com IMMORTAL (Malware_Distribution)"; content:"|0a|sis-street|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitec-med.com IMMORTAL (Malware_Distribution)"; content:"|09|sitec-med|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitemaps.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|sitemaps|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skzart.com IMMORTAL (Malware_Distribution)"; content:"|06|skzart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup surbhisoft.com IMMORTAL (Malware_Distribution)"; content:"|0a|surbhisoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tallestbuildingslist.com IMMORTAL (Malware_Distribution)"; content:"|14|tallestbuildingslist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tejasindia.com IMMORTAL (Malware_Distribution)"; content:"|0a|tejasindia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eva-marine.info IMMORTAL (Malware_Distribution)"; content:"|0a|eva-marine|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extra-service.info IMMORTAL (Malware_Distribution)"; content:"|0d|extra-service|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tzv-stats.info IMMORTAL (Malware_Distribution)"; content:"|09|tzv-stats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alexblane.com IMMORTAL (Spyware)"; content:"|09|alexblane|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yeryeshsdhdhjfdhj.vv.cc IMMORTAL (Phishing_and_Theft)"; content:"|11|yeryeshsdhdhjfdhj|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdelles.com IMMORTAL (Malware_Distribution)"; content:"|07|bdelles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestcv.ro IMMORTAL (Malware_Distribution)"; content:"|06|bestcv|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradeservise.com IMMORTAL (Malware_Distribution)"; content:"|0c|tradeservise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1x.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5t.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0a.ru IMMORTAL (Malware_Distribution)"; content:"|03|x0a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0q.ru IMMORTAL (Malware_Distribution)"; content:"|03|x0q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8b.in IMMORTAL (Malware_Distribution)"; content:"|03|x8b|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8b.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ediltermo.com IMMORTAL (Malware_Distribution)"; content:"|09|ediltermo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewebtown.com IMMORTAL (Malware_Distribution)"; content:"|0b|freewebtown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1brd.kz IMMORTAL (Malware_Distribution)"; content:"|04|1brd|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39b.ru IMMORTAL (Malware_Distribution)"; content:"|03|39b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abdulabah.cn IMMORTAL (Malware_Distribution)"; content:"|09|abdulabah|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adserv.cn IMMORTAL (Malware_Infectors)"; content:"|06|adserv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c5p.ru IMMORTAL (Malware_Distribution)"; content:"|03|c5p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c7r.ru IMMORTAL (Malware_Distribution)"; content:"|03|c7r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup craprofe.evoconcept.net IMMORTAL (Malware_Distribution)"; content:"|08|craprofe|0a|evoconcept|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddl2.pl IMMORTAL (Malware_Distribution)"; content:"|04|ddl2|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elantrasantrope.ru IMMORTAL (Malware_Distribution)"; content:"|0f|elantrasantrope|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hepberaberiz.net IMMORTAL (Malware_Distribution)"; content:"|0c|hepberaberiz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jitoshaadi.com IMMORTAL (Malware_Distribution)"; content:"|0a|jitoshaadi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joperty.net IMMORTAL (Malware_Distribution)"; content:"|07|joperty|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livertip.com IMMORTAL (Malware_Distribution)"; content:"|08|livertip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maximumesystem.com IMMORTAL (Malware_Distribution)"; content:"|0e|maximumesystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minisearch.co.kr IMMORTAL (Malware_Distribution)"; content:"|0a|minisearch|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mix-plus.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|mix-plus|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns10-wistee.fr IMMORTAL (Malware_Distribution)"; content:"|0b|ns10-wistee|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ottomansguild.com IMMORTAL (Malware_Distribution)"; content:"|0d|ottomansguild|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup street-info.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0b|street-info|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trainings4u.com IMMORTAL (Malware_Distribution)"; content:"|0b|trainings4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truemini.co.cc IMMORTAL (Malware_Distribution)"; content:"|08|truemini|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waistor.com IMMORTAL (Malware_Distribution)"; content:"|07|waistor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zajimavost.cz IMMORTAL (Malware_Distribution)"; content:"|0a|zajimavost|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atesterzi.com IMMORTAL (Malware_Distribution)"; content:"|09|atesterzi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axa3.cn IMMORTAL (Malware_Distribution)"; content:"|04|axa3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup busheyframingservices.co.uk IMMORTAL (Malware_Distribution)"; content:"|15|busheyframingservices|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chriseden73.free.fr IMMORTAL (Malware_Distribution)"; content:"|0b|chriseden73|04|free|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsms.in IMMORTAL (Malware_Distribution)"; content:"|04|dsms|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hirodomain.com IMMORTAL (Malware_Distribution)"; content:"|0a|hirodomain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jejushinshin.co.kr IMMORTAL (Malware_Distribution)"; content:"|0c|jejushinshin|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariosflyingpizzaclearlake.com IMMORTAL (Malware_Distribution)"; content:"|1a|mariosflyingpizzaclearlake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moonlightw.mireene.com IMMORTAL (Malware_Distribution)"; content:"|0a|moonlightw|07|mireene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muslimhands.org.sd IMMORTAL (Malware_Distribution)"; content:"|0b|muslimhands|03|org|02|sd"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patriots4ai.com IMMORTAL (Malware_Distribution)"; content:"|0b|patriots4ai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup razumtds.ws IMMORTAL (Malware_Distribution)"; content:"|08|razumtds|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sabnorway.com IMMORTAL (Malware_Distribution)"; content:"|09|sabnorway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wizu.webd.pl IMMORTAL (Malware_Distribution)"; content:"|04|wizu|04|webd|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8u.in IMMORTAL (Malware_Distribution)"; content:"|03|x8u|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8u.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9d.in IMMORTAL (Malware_Distribution)"; content:"|03|x9d|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaduheljtw.ru IMMORTAL (Malware_Distribution)"; content:"|0a|zaduheljtw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zxsoftpromo.ru IMMORTAL (Malware_Distribution)"; content:"|0b|zxsoftpromo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficforalz.org IMMORTAL (Malware_Distribution)"; content:"|0d|trafficforalz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alcobro.net IMMORTAL (Malware_Distribution)"; content:"|07|alcobro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cattww.com IMMORTAL (Malware_Distribution)"; content:"|06|cattww|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curem.net IMMORTAL (Malware_Distribution)"; content:"|05|curem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup description2011.ru IMMORTAL (Malware_Distribution)"; content:"|0f|description2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u4anz.co.cc IMMORTAL (Malware_Distribution)"; content:"|05|u4anz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zenrumor.ru IMMORTAL (Malware_Distribution)"; content:"|08|zenrumor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bumin.org IMMORTAL (Malware_Distribution)"; content:"|05|bumin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strikeallow.ru IMMORTAL (Malware_Distribution)"; content:"|0b|strikeallow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uxqt.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|uxqt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vauzdftjok.ru IMMORTAL (Spyware)"; content:"|0a|vauzdftjok|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup busderaskon.com IMMORTAL (Malware_Infectors)"; content:"|0b|busderaskon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotothhi.be IMMORTAL (Malware_Distribution)"; content:"|08|fotothhi|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirus023.com IMMORTAL (Fake_AV)"; content:"|10|web-antivirus023|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xbl.kz IMMORTAL (Malware_Distribution)"; content:"|03|xbl|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilsearch.com IMMORTAL (Malware_Infectors)"; content:"|08|ilsearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vernonmusic.com IMMORTAL (Spyware)"; content:"|0b|vernonmusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypoints.kr IMMORTAL (Malware_Distribution)"; content:"|08|mypoints|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0j.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xq1.ru IMMORTAL (Malware_Distribution)"; content:"|03|xq1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xq8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xq8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9966.org IMMORTAL (Malware_Distribution)"; content:"|04|9966|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tartonion.ru IMMORTAL (Malware_Distribution)"; content:"|09|tartonion|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f8a.ru IMMORTAL (Malware_Distribution)"; content:"|03|f8a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup florinlelcu.lx.ro IMMORTAL (Malware_Infectors)"; content:"|0b|florinlelcu|02|lx|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restaurantinsuranceonthego.com IMMORTAL (Malware_Infectors)"; content:"|1a|restaurantinsuranceonthego|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richlandproperties.ca IMMORTAL (Malware_Infectors)"; content:"|12|richlandproperties|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delzzerro.cn IMMORTAL (Malware_Distribution)"; content:"|09|delzzerro|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gengblogger.com IMMORTAL (Malware_Distribution)"; content:"|0b|gengblogger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjangq.co.kr IMMORTAL (Malware_Distribution)"; content:"|06|jjangq|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freehotgay.com IMMORTAL (Malware_Distribution)"; content:"|0a|freehotgay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanovoice.ru IMMORTAL (Malware_Distribution)"; content:"|09|nanovoice|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viranti.ru IMMORTAL (Malware_Distribution)"; content:"|07|viranti|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xenoncenter.com IMMORTAL (Malware_Distribution)"; content:"|0b|xenoncenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-stats201.info IMMORTAL (Malware_Distribution)"; content:"|0f|online-stats201|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup depenam.com IMMORTAL (Malware_Distribution)"; content:"|07|depenam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fishum.com IMMORTAL (Malware_Distribution)"; content:"|06|fishum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiggete.com IMMORTAL (Malware_Distribution)"; content:"|07|wiggete|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsdgsdhsh.vv.cc IMMORTAL (Malware_Distribution)"; content:"|09|gsdgsdhsh|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 18dd.net IMMORTAL (Malware_Distribution)"; content:"|04|18dd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxtoolbar.com IMMORTAL (Malware_Infectors)"; content:"|0a|xxxtoolbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2601512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goooogleadsence.biz IMMORTAL (Malware_Distribution)"; content:"|0f|goooogleadsence|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgeshacks.net IMMORTAL (Malware_Distribution)"; content:"|0a|imgeshacks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parohiabunavestirebelu.go.ro IMMORTAL (Malware_Distribution)"; content:"|16|parohiabunavestirebelu|02|go|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjmsvmttc.org IMMORTAL (Malware_Distribution)"; content:"|09|sjmsvmttc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup studioai.kr IMMORTAL (Malware_Distribution)"; content:"|08|studioai|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tynyturi.com IMMORTAL (Malware_Distribution)"; content:"|08|tynyturi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urinoor.com IMMORTAL (Malware_Distribution)"; content:"|07|urinoor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wenmo.in IMMORTAL (Malware_Distribution)"; content:"|05|wenmo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwtraff.com IMMORTAL (Malware_Distribution)"; content:"|08|wwwtraff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gvppjnjv.net.in IMMORTAL (Malware_Distribution)"; content:"|08|gvppjnjv|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helphomecare.at IMMORTAL (SEO_Fraud)"; content:"|0c|helphomecare|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livelnternet.net IMMORTAL (Malware_Distribution)"; content:"|0c|livelnternet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvvvc.co.cc IMMORTAL (Malware_Distribution)"; content:"|05|vvvvc|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allspade.ru IMMORTAL (Malware_Distribution)"; content:"|08|allspade|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fitblues.ru IMMORTAL (Malware_Distribution)"; content:"|08|fitblues|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hairyplant.ru IMMORTAL (Malware_Distribution)"; content:"|0a|hairyplant|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idealsword.ru IMMORTAL (Malware_Distribution)"; content:"|0a|idealsword|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superiot.ru IMMORTAL (Malware_Distribution)"; content:"|08|superiot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2-kolka.pl IMMORTAL (Malware_Distribution)"; content:"|07|2-kolka|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asfirey.net IMMORTAL (Malware_Distribution)"; content:"|07|asfirey|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directsupershop.com IMMORTAL (Malware_Distribution)"; content:"|0f|directsupershop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugfreecard.info IMMORTAL (Malware_Distribution)"; content:"|0c|drugfreecard|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esntionlatino.com IMMORTAL (Malware_Distribution)"; content:"|0d|esntionlatino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kauzliten.com IMMORTAL (Malware_Distribution)"; content:"|09|kauzliten|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lineacount.info IMMORTAL (Malware_Distribution)"; content:"|0a|lineacount|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywowtv.org IMMORTAL (Malware_Distribution)"; content:"|07|mywowtv|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swayam.co.uk IMMORTAL (Malware_Distribution)"; content:"|06|swayam|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetztvorun.net IMMORTAL (Malware_Infectors)"; content:"|0a|jetztvorun|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jookest.in IMMORTAL (Malware_Infectors)"; content:"|07|jookest|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opperlant.com IMMORTAL (Malware_Infectors)"; content:"|09|opperlant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtuellvorun.org IMMORTAL (Malware_Infectors)"; content:"|0d|virtuellvorun|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oughwa.com IMMORTAL (Malware_Infectors)"; content:"|06|oughwa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euy0.co.cc IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|04|euy0|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jeelex.net IMMORTAL (Malware_Infectors)"; content:"|06|jeelex|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gate4ads.info IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|08|gate4ads|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup general-st.info IMMORTAL (Malware_Distribution)"; content:"|0a|general-st|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoid.in IMMORTAL (Malware_Distribution)"; content:"|04|zoid|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-stats49.info IMMORTAL (Malware_Infectors)"; content:"|0e|google-stats49|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multi-stats.info IMMORTAL (Malware_Infectors)"; content:"|0b|multi-stats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zanfo.it IMMORTAL (Malware_Distribution)"; content:"|05|zanfo|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redpoo.com IMMORTAL (Malware_Infectors)"; content:"|06|redpoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-counter.cn IMMORTAL (Malware_Distribution)"; content:"|0e|online-counter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analytlcs.com IMMORTAL (Malware_Distribution)"; content:"|10|google-analytlcs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatliteautobest.cn IMMORTAL (Malware_Distribution)"; content:"|11|greatliteautobest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z360.net IMMORTAL (Malware_Distribution)"; content:"|04|z360|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleanalytlcs.net IMMORTAL (Malware_Distribution)"; content:"|0f|googleanalytlcs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grepad.com IMMORTAL (Malware_Infectors)"; content:"|06|grepad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treplikon.com IMMORTAL (Malware_Distribution)"; content:"|09|treplikon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wowtribes.com IMMORTAL (Malware_Distribution)"; content:"|09|wowtribes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yougoodvideo.net IMMORTAL (Malware_Distribution)"; content:"|0c|yougoodvideo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3x.ro IMMORTAL (Malware_Distribution)"; content:"|02|3x|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huil.in IMMORTAL (Malware_Distribution)"; content:"|04|huil|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v00d00.org IMMORTAL (Malware_Distribution)"; content:"|06|v00d00|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4safe.in IMMORTAL (Malware_Distribution)"; content:"|05|4safe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aimauto.org IMMORTAL (Malware_Distribution)"; content:"|07|aimauto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allnaturalpornstars.com IMMORTAL (Malware_Distribution)"; content:"|13|allnaturalpornstars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annuairemedicaloran.com IMMORTAL (Malware_Distribution)"; content:"|13|annuairemedicaloran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anyscent.ru IMMORTAL (SEO_Fraud)"; content:"|08|anyscent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arsenalforum.cekuj.net IMMORTAL (Malware_Distribution)"; content:"|0c|arsenalforum|05|cekuj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beachhub.info IMMORTAL (Malware_Distribution)"; content:"|08|beachhub|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmortgagefind.cn IMMORTAL (Malware_Distribution)"; content:"|10|bestmortgagefind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daddybigtop.cn IMMORTAL (Malware_Distribution)"; content:"|0b|daddybigtop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dionneg.com IMMORTAL (Malware_Distribution)"; content:"|07|dionneg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diretctrishta.com IMMORTAL (Malware_Distribution)"; content:"|0d|diretctrishta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eskuvoiszalon.hu IMMORTAL (Malware_Distribution)"; content:"|0d|eskuvoiszalon|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastbusinessleads.com IMMORTAL (Malware_Distribution)"; content:"|11|fastbusinessleads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grizzli-counter.com IMMORTAL (Malware_Distribution)"; content:"|0f|grizzli-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guppypetshop.com IMMORTAL (Malware_Distribution)"; content:"|0c|guppypetshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugetopnonfat.cn IMMORTAL (Malware_Distribution)"; content:"|0d|hugetopnonfat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kandrarkkm.org IMMORTAL (Malware_Distribution)"; content:"|0a|kandrarkkm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knuenglish.co.kr IMMORTAL (Malware_Distribution)"; content:"|0a|knuenglish|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotbetworld.cn IMMORTAL (Malware_Distribution)"; content:"|0b|lotbetworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millionsdream.cn IMMORTAL (Malware_Distribution)"; content:"|0d|millionsdream|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namestorevideo.cn IMMORTAL (Malware_Distribution)"; content:"|0e|namestorevideo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt04.in IMMORTAL (Malware_Distribution)"; content:"|04|nt04|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peskostruikaz.com IMMORTAL (Malware_Distribution)"; content:"|0d|peskostruikaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pioneers-online.co.in IMMORTAL (Malware_Distribution)"; content:"|0f|pioneers-online|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup placeforfun.nl IMMORTAL (Malware_Distribution)"; content:"|0b|placeforfun|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rsequitytips.com IMMORTAL (Malware_Distribution)"; content:"|0c|rsequitytips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saba-ac.com IMMORTAL (Malware_Distribution)"; content:"|07|saba-ac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup social-stats.info IMMORTAL (Malware_Distribution)"; content:"|0c|social-stats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testossteron.ru IMMORTAL (Malware_Distribution)"; content:"|0c|testossteron|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topaylar.com.tr IMMORTAL (Malware_Distribution)"; content:"|08|topaylar|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ymcakorea.org IMMORTAL (Malware_Distribution)"; content:"|09|ymcakorea|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youngorfabric.com IMMORTAL (Malware_Distribution)"; content:"|0d|youngorfabric|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeroclan.net IMMORTAL (Malware_Distribution)"; content:"|08|zeroclan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zymkasi.com IMMORTAL (Malware_Distribution)"; content:"|07|zymkasi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aikyu.ru IMMORTAL (SEO_Fraud)"; content:"|05|aikyu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alisa-carter.com IMMORTAL (Malware_Distribution)"; content:"|0c|alisa-carter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betstarwager.cn IMMORTAL (Malware_Distribution)"; content:"|0c|betstarwager|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup escribaniaquinterno.com.ar IMMORTAL (Malware_Distribution)"; content:"|13|escribaniaquinterno|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup game163.in IMMORTAL (Malware_Distribution)"; content:"|07|game163|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqckly.ru IMMORTAL (SEO_Fraud)"; content:"|06|iqckly|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parktadimrestaurant.com IMMORTAL (Malware_Distribution)"; content:"|13|parktadimrestaurant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup query-google.com IMMORTAL (Malware_Distribution)"; content:"|0c|query-google|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reberi.com IMMORTAL (Malware_Distribution)"; content:"|06|reberi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafdriver.com IMMORTAL (Malware_Distribution)"; content:"|0a|trafdriver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naty.org IMMORTAL (Malware_Distribution)"; content:"|04|naty|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novustvnet.com IMMORTAL (Malware_Distribution)"; content:"|0a|novustvnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storyfold.info IMMORTAL (Malware_Distribution)"; content:"|09|storyfold|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ar-kirm.ru IMMORTAL (Fake_AV)"; content:"|07|ar-kirm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piupiu7.co.cc IMMORTAL (Fake_AV)"; content:"|07|piupiu7|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup islamwelt.ch IMMORTAL (Malware_Distribution)"; content:"|09|islamwelt|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lingamcabs.com IMMORTAL (Malware_Distribution)"; content:"|0a|lingamcabs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nemohuildiin.ru IMMORTAL (Malware_Infectors)"; content:"|0c|nemohuildiin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tenthprofit.ru IMMORTAL (Malware_Distribution)"; content:"|0b|tenthprofit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wtopcompany.biz IMMORTAL (Malware_Distribution)"; content:"|0b|wtopcompany|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ankursociety.org IMMORTAL (Malware_Infectors)"; content:"|0c|ankursociety|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inartdesigns.com IMMORTAL (Botnet_C&C)"; content:"|0c|inartdesigns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup its-email.co.uk IMMORTAL (Botnet_C&C)"; content:"|09|its-email|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lasur8e.com IMMORTAL (Malware_Infectors)"; content:"|07|lasur8e|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muddbowl.com IMMORTAL (Malware_Infectors)"; content:"|08|muddbowl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordamerika-invest.com IMMORTAL (Malware_Infectors)"; content:"|12|nordamerika-invest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pills.ind.in IMMORTAL (Spyware)"; content:"|05|pills|03|ind|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unb0rn.biz IMMORTAL (Malware_Infectors)"; content:"|06|unb0rn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modinali.com IMMORTAL (Malware_Distribution)"; content:"|08|modinali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopescorts.cn IMMORTAL (Malware_Distribution)"; content:"|0d|bigtopescorts|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recover88888.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0c|recover88888|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abugyhe.cn IMMORTAL (Malware_Distribution)"; content:"|07|abugyhe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afyopku.cn IMMORTAL (Malware_Distribution)"; content:"|07|afyopku|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahukyh.cn IMMORTAL (Malware_Distribution)"; content:"|06|ahukyh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajoibe.cn IMMORTAL (Malware_Distribution)"; content:"|06|ajoibe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akaelyr.cn IMMORTAL (Malware_Distribution)"; content:"|07|akaelyr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akebuop.cn IMMORTAL (Malware_Distribution)"; content:"|07|akebuop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akouzo.cn IMMORTAL (Malware_Distribution)"; content:"|06|akouzo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amuejgo.cn IMMORTAL (Malware_Distribution)"; content:"|07|amuejgo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anuyqve.cn IMMORTAL (Malware_Distribution)"; content:"|07|anuyqve|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apuarym.cn IMMORTAL (Malware_Distribution)"; content:"|07|apuarym|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axokawe.cn IMMORTAL (Malware_Distribution)"; content:"|07|axokawe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup botezsu.cn IMMORTAL (Malware_Distribution)"; content:"|07|botezsu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceqycfa.cn IMMORTAL (Malware_Distribution)"; content:"|07|ceqycfa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebyazro.cn IMMORTAL (Malware_Distribution)"; content:"|07|ebyazro|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup efoelug.cn IMMORTAL (Malware_Distribution)"; content:"|07|efoelug|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egaxies.cn IMMORTAL (Malware_Distribution)"; content:"|07|egaxies|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exezaho.cn IMMORTAL (Malware_Distribution)"; content:"|07|exezaho|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fizhox.cn IMMORTAL (Malware_Distribution)"; content:"|06|fizhox|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyqtewa.cn IMMORTAL (Malware_Distribution)"; content:"|07|fyqtewa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldrushphone.cn IMMORTAL (Malware_Distribution)"; content:"|0d|goldrushphone|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup handharmony.cn IMMORTAL (Malware_Distribution)"; content:"|0b|handharmony|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup havirfy.cn IMMORTAL (Malware_Distribution)"; content:"|07|havirfy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyzhaje.cn IMMORTAL (Malware_Distribution)"; content:"|07|jyzhaje|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lebisuf.cn IMMORTAL (Malware_Distribution)"; content:"|07|lebisuf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ligpeos.cn IMMORTAL (Malware_Distribution)"; content:"|07|ligpeos|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linhaky.cn IMMORTAL (Malware_Distribution)"; content:"|07|linhaky|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liqedjo.cn IMMORTAL (Malware_Distribution)"; content:"|07|liqedjo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liwgabe.cn IMMORTAL (Malware_Distribution)"; content:"|07|liwgabe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovpiny.cn IMMORTAL (Malware_Distribution)"; content:"|07|lovpiny|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luljeco.cn IMMORTAL (Malware_Distribution)"; content:"|07|luljeco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luqfeoh.cn IMMORTAL (Malware_Distribution)"; content:"|07|luqfeoh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lytucak.cn IMMORTAL (Malware_Distribution)"; content:"|07|lytucak|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup misgyow.cn IMMORTAL (Malware_Distribution)"; content:"|07|misgyow|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myqvaic.cn IMMORTAL (Malware_Distribution)"; content:"|07|myqvaic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obejoys.cn IMMORTAL (Malware_Distribution)"; content:"|07|obejoys|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oloibge.cn IMMORTAL (Malware_Distribution)"; content:"|07|oloibge|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omuahed.cn IMMORTAL (Malware_Distribution)"; content:"|07|omuahed|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opyaxa.cn IMMORTAL (Malware_Distribution)"; content:"|06|opyaxa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pivozec.cn IMMORTAL (Malware_Distribution)"; content:"|07|pivozec|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qormyv.cn IMMORTAL (Malware_Distribution)"; content:"|06|qormyv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reviewsfinance.cn IMMORTAL (Malware_Distribution)"; content:"|0e|reviewsfinance|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smilecourage.cn IMMORTAL (Malware_Distribution)"; content:"|0c|smilecourage|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tibemka.cn IMMORTAL (Malware_Distribution)"; content:"|07|tibemka|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolboxhome.cn IMMORTAL (Malware_Distribution)"; content:"|0b|toolboxhome|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ufouqib.cn IMMORTAL (Malware_Distribution)"; content:"|07|ufouqib|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ugolyxa.cn IMMORTAL (Malware_Distribution)"; content:"|07|ugolyxa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukyfeuw.cn IMMORTAL (Malware_Distribution)"; content:"|07|ukyfeuw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urosina.cn IMMORTAL (Malware_Distribution)"; content:"|07|urosina|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wufimo.cn IMMORTAL (Malware_Distribution)"; content:"|06|wufimo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xicgoku.cn IMMORTAL (Malware_Distribution)"; content:"|07|xicgoku|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xojede.cn IMMORTAL (Malware_Distribution)"; content:"|06|xojede|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ycauqel.cn IMMORTAL (Malware_Distribution)"; content:"|07|ycauqel|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ydugoh.cn IMMORTAL (Malware_Distribution)"; content:"|06|ydugoh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zezmah.cn IMMORTAL (Malware_Distribution)"; content:"|06|zezmah|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zopyfa.cn IMMORTAL (Malware_Distribution)"; content:"|06|zopyfa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zuchiom.cn IMMORTAL (Malware_Distribution)"; content:"|07|zuchiom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestnameshop.cn IMMORTAL (Malware_Distribution)"; content:"|0c|bestnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigbestfind.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bigbestfind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopmanagement.cn IMMORTAL (Malware_Distribution)"; content:"|10|bigtopmanagement|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securelive.co.kr IMMORTAL (Malware_Infectors)"; content:"|0a|securelive|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanlation.net IMMORTAL (Malware_Distribution)"; content:"|0a|scanlation|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obscurewax.ru IMMORTAL (Malware_Distribution)"; content:"|0a|obscurewax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secondgain.ru IMMORTAL (Malware_Distribution)"; content:"|0a|secondgain|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shortrib.ru IMMORTAL (Malware_Distribution)"; content:"|08|shortrib|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starvingarctic.ru IMMORTAL (Malware_Distribution)"; content:"|0e|starvingarctic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analystisc.com IMMORTAL (Malware_Distribution)"; content:"|11|google-analystisc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigalife.info IMMORTAL (Malware_Distribution)"; content:"|08|gigalife|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldmsc.info IMMORTAL (Malware_Distribution)"; content:"|07|goldmsc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 000007.ru IMMORTAL (Malware_Distribution)"; content:"|06|000007|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x1v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x1v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htresq.com IMMORTAL (Malware_Distribution)"; content:"|06|htresq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunqtr.com IMMORTAL (Malware_Distribution)"; content:"|06|sunqtr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ysbweb.com IMMORTAL (Malware_Distribution)"; content:"|06|ysbweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2603300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfindaloan.cn IMMORTAL (Malware_Distribution)"; content:"|0d|bestfindaloan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigpremiumfind.cn IMMORTAL (Malware_Distribution)"; content:"|0e|bigpremiumfind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigskytopguide.cn IMMORTAL (Malware_Distribution)"; content:"|0e|bigskytopguide|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bablodos.com IMMORTAL (Malware_Distribution)"; content:"|08|bablodos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solodov.in IMMORTAL (Malware_Infectors)"; content:"|07|solodov|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tds-info.net IMMORTAL (Malware_Infectors)"; content:"|08|tds-info|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6600.org IMMORTAL (Malware_Distribution)"; content:"|04|6600|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8800.org IMMORTAL (Malware_Distribution)"; content:"|04|8800|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8866.org IMMORTAL (Malware_Distribution)"; content:"|04|8866|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alkte.com IMMORTAL (Malware_Distribution)"; content:"|05|alkte|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deinglaube.com IMMORTAL (Malware_Distribution)"; content:"|0a|deinglaube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixnitor.com IMMORTAL (Malware_Distribution)"; content:"|07|ixnitor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup printinstant.com IMMORTAL (Malware_Distribution)"; content:"|0c|printinstant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sgviralscan.com IMMORTAL (Malware_Distribution)"; content:"|0b|sgviralscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shtos.ru IMMORTAL (Malware_Distribution)"; content:"|05|shtos|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagdol.dothome.co.kr IMMORTAL (Malware_Distribution)"; content:"|06|tagdol|07|dothome|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uin1.cn IMMORTAL (Malware_Distribution)"; content:"|04|uin1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uin2.cn IMMORTAL (Malware_Distribution)"; content:"|04|uin2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 123kochi.com IMMORTAL (Malware_Distribution)"; content:"|08|123kochi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwordanalitycs.ru IMMORTAL (SEO_Fraud)"; content:"|0f|adwordanalitycs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b-i-o-v.ru IMMORTAL (SEO_Fraud)"; content:"|07|b-i-o-v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bicodehl.com IMMORTAL (Malware_Distribution)"; content:"|08|bicodehl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brokersearch.co.za IMMORTAL (Malware_Distribution)"; content:"|0c|brokersearch|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickmeter.ru IMMORTAL (SEO_Fraud)"; content:"|0a|clickmeter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dedlife.ru IMMORTAL (SEO_Fraud)"; content:"|07|dedlife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doubleclickr.ru IMMORTAL (SEO_Fraud)"; content:"|0c|doubleclickr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iquotient.ru IMMORTAL (SEO_Fraud)"; content:"|09|iquotient|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masturbacja.ovh.org IMMORTAL (Malware_Distribution)"; content:"|0b|masturbacja|03|ovh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nexprice.com IMMORTAL (Malware_Distribution)"; content:"|08|nexprice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plusbest.ru IMMORTAL (SEO_Fraud)"; content:"|08|plusbest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raviganeshassociates.com IMMORTAL (Malware_Distribution)"; content:"|14|raviganeshassociates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saeed-photo.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|0b|saeed-photo|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siteanalitycs.ru IMMORTAL (SEO_Fraud)"; content:"|0d|siteanalitycs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup srpskidespot.org.rs IMMORTAL (Malware_Distribution)"; content:"|0c|srpskidespot|03|org|02|rs"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersidecar.ru IMMORTAL (SEO_Fraud)"; content:"|0c|supersidecar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testometr.ru IMMORTAL (SEO_Fraud)"; content:"|09|testometr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theeasyriver.ru IMMORTAL (SEO_Fraud)"; content:"|0c|theeasyriver|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timdizayn.ru IMMORTAL (Malware_Distribution)"; content:"|09|timdizayn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoosite.ru IMMORTAL (SEO_Fraud)"; content:"|09|yahoosite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zief.pl IMMORTAL (Malware_Infectors)"; content:"|04|zief|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1.ripway.com IMMORTAL (Malware_Distribution)"; content:"|02|h1|06|ripway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jx2dbtwg.com IMMORTAL (Malware_Distribution)"; content:"|08|jx2dbtwg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oooabterast0.co.cc IMMORTAL (Malware_Distribution)"; content:"|0c|oooabterast0|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websmeter.com IMMORTAL (Malware_Distribution)"; content:"|09|websmeter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qq12300.com IMMORTAL (Fake_AV)"; content:"|07|qq12300|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golddeery.info IMMORTAL (Malware_Distribution)"; content:"|09|golddeery|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litend.com IMMORTAL (Malware_Distribution)"; content:"|06|litend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skkedu.co.kr IMMORTAL (Malware_Distribution)"; content:"|06|skkedu|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlkasfgatker.com IMMORTAL (Malware_Infectors)"; content:"|0c|dlkasfgatker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kotopes.cn IMMORTAL (Malware_Infectors)"; content:"|07|kotopes|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pivfeels.com IMMORTAL (Spyware)"; content:"|08|pivfeels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 90000000.ru IMMORTAL (Malware_Infectors)"; content:"|08|90000000|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads-t.ru IMMORTAL (Malware_Distribution)"; content:"|05|ads-t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cometruestar.ru IMMORTAL (Malware_Distribution)"; content:"|0c|cometruestar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genuinecolors.ru IMMORTAL (Malware_Distribution)"; content:"|0d|genuinecolors|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herangi.com IMMORTAL (Botnet_C&C)"; content:"|07|herangi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup madcmx.mx IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|06|madcmx|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypersonalhttp.com IMMORTAL (Spyware)"; content:"|0e|mypersonalhttp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usepetrol2earn.com IMMORTAL (Malware_Distribution)"; content:"|0e|usepetrol2earn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reglasti.com IMMORTAL (Malware_Distribution)"; content:"|08|reglasti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rokobon.com IMMORTAL (Malware_Infectors)"; content:"|07|rokobon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3322.org IMMORTAL (Malware_Distribution)"; content:"|04|3322|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2605536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkhteqa.com IMMORTAL (Malware_Distribution)"; content:"|07|jkhteqa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mybar.us IMMORTAL (Malware_Distribution)"; content:"|05|mybar|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup im.ne.kr IMMORTAL (Malware_Distribution)"; content:"|02|im|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parthsoft.com IMMORTAL (Malware_Distribution)"; content:"|09|parthsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinarlikoyu.com IMMORTAL (Malware_Distribution)"; content:"|0b|pinarlikoyu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plmag.net IMMORTAL (Malware_Distribution)"; content:"|05|plmag|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pqshow.org IMMORTAL (Malware_Distribution)"; content:"|06|pqshow|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup se-group.de IMMORTAL (Malware_Distribution)"; content:"|08|se-group|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seoshell.com IMMORTAL (Malware_Distribution)"; content:"|08|seoshell|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonyericsson.lua.pl IMMORTAL (Malware_Distribution)"; content:"|0c|sonyericsson|03|lua|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats-master88.info IMMORTAL (Malware_Distribution)"; content:"|0e|stats-master88|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats-master99.info IMMORTAL (Malware_Distribution)"; content:"|0e|stats-master99|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liagand.cn IMMORTAL (Malware_Distribution)"; content:"|07|liagand|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup augami.net IMMORTAL (Malware_Distribution)"; content:"|06|augami|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olokedu.com IMMORTAL (Malware_Distribution)"; content:"|07|olokedu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup offiget.ru IMMORTAL (Malware_Distribution)"; content:"|07|offiget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 114oldest.com IMMORTAL (Malware_Distribution)"; content:"|09|114oldest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alpine-balloon-challenge.ch IMMORTAL (Malware_Distribution)"; content:"|18|alpine-balloon-challenge|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldtmv.info IMMORTAL (Malware_Distribution)"; content:"|07|goldtmv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iaachamber.com IMMORTAL (Malware_Distribution)"; content:"|0a|iaachamber|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in-in.in IMMORTAL (Malware_Distribution)"; content:"|05|in-in|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup majnon313.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|09|majnon313|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manafnet.com IMMORTAL (Malware_Distribution)"; content:"|08|manafnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marmaratriko.net IMMORTAL (Malware_Distribution)"; content:"|0c|marmaratriko|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup najbolja-zabava.com IMMORTAL (Malware_Distribution)"; content:"|0f|najbolja-zabava|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ngl.kr IMMORTAL (Malware_Distribution)"; content:"|03|ngl|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obec.go.th IMMORTAL (Malware_Distribution)"; content:"|04|obec|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pennystock-picks.info IMMORTAL (Malware_Distribution)"; content:"|10|pennystock-picks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plasmahdtvratings.com IMMORTAL (Malware_Distribution)"; content:"|11|plasmahdtvratings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pmgkorea.com IMMORTAL (Malware_Distribution)"; content:"|08|pmgkorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roomart.info IMMORTAL (Malware_Distribution)"; content:"|07|roomart|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruooo.com IMMORTAL (Malware_Distribution)"; content:"|05|ruooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swissarmyknifes.us IMMORTAL (Malware_Distribution)"; content:"|0f|swissarmyknifes|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tattoo-h.com IMMORTAL (Malware_Distribution)"; content:"|08|tattoo-h|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testilla.ru IMMORTAL (Malware_Distribution)"; content:"|08|testilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thaibadmintonclub.com IMMORTAL (Malware_Distribution)"; content:"|11|thaibadmintonclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theatrekoodak.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|0d|theatrekoodak|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tngthai.com IMMORTAL (Malware_Distribution)"; content:"|07|tngthai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w00d00pipls.net IMMORTAL (Malware_Distribution)"; content:"|0b|w00d00pipls|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woo-gie.com IMMORTAL (Malware_Distribution)"; content:"|07|woo-gie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retireterrify.ru IMMORTAL (Malware_Infectors)"; content:"|0d|retireterrify|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banan-service.org IMMORTAL (Malware_Distribution)"; content:"|0d|banan-service|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkbioindia.com IMMORTAL (Malware_Distribution)"; content:"|0a|jkbioindia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clicksor.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|08|clicksor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup date-me.ro IMMORTAL (Malware_Distribution)"; content:"|07|date-me|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j5b.kr IMMORTAL (Malware_Distribution)"; content:"|03|j5b|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serfinworld.com IMMORTAL (Malware_Distribution)"; content:"|0b|serfinworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowardtor2010movie.co.cc IMMORTAL (Malware_Distribution)"; content:"|12|gowardtor2010movie|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maharath.com IMMORTAL (Malware_Distribution)"; content:"|08|maharath|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlke.ru IMMORTAL (Malware_Distribution)"; content:"|04|qlke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wordwacker.com IMMORTAL (Spyware)"; content:"|0a|wordwacker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpuconsulting.co.cc IMMORTAL (Malware_Infectors)"; content:"|0d|cpuconsulting|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dualmenu.co.cc IMMORTAL (Malware_Infectors)"; content:"|08|dualmenu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolctg.com IMMORTAL (Malware_Infectors)"; content:"|06|kolctg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12s83.com IMMORTAL (Malware_Distribution)"; content:"|05|12s83|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup semikemi.info IMMORTAL (Malware_Distribution)"; content:"|08|semikemi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rijagt.dk IMMORTAL (Malware_Distribution)"; content:"|06|rijagt|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sanahr.com IMMORTAL (Malware_Distribution)"; content:"|06|sanahr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allowstrike.ru IMMORTAL (Malware_Distribution)"; content:"|0b|allowstrike|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awm-magazine.ru IMMORTAL (Malware_Distribution)"; content:"|0c|awm-magazine|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cassandrarice.com IMMORTAL (Malware_Distribution)"; content:"|0d|cassandrarice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countinfo.com IMMORTAL (Malware_Distribution)"; content:"|09|countinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup julyrelax.ru IMMORTAL (Malware_Distribution)"; content:"|09|julyrelax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magazineawm.ru IMMORTAL (Malware_Distribution)"; content:"|0b|magazineawm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traypro.ru IMMORTAL (Malware_Distribution)"; content:"|07|traypro|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuta-anti.ru IMMORTAL (Malware_Distribution)"; content:"|09|tuta-anti|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tutaanti.ru IMMORTAL (Malware_Distribution)"; content:"|08|tutaanti|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tutavir.ru IMMORTAL (Malware_Distribution)"; content:"|07|tutavir|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visitthermal.ru IMMORTAL (Malware_Distribution)"; content:"|0c|visitthermal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wizrd-enterteiment.ru IMMORTAL (Malware_Distribution)"; content:"|12|wizrd-enterteiment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wizrdenterteiment.ru IMMORTAL (Malware_Distribution)"; content:"|11|wizrdenterteiment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeaaea.com IMMORTAL (Malware_Distribution)"; content:"|06|aeaaea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awaue.com IMMORTAL (Malware_Distribution)"; content:"|05|awaue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup berfry43bgrbf.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0d|berfry43bgrbf|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euuaw.com IMMORTAL (Malware_Distribution)"; content:"|05|euuaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g243gtdsgsdg.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0c|g243gtdsgsdg|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glkgj5j4rshdfhj.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0f|glkgj5j4rshdfhj|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gs34grsgdg.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0a|gs34grsgdg|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsdg3gsdgsdg.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0c|gsdg3gsdgsdg|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jfgdhdfhsdfh.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0c|jfgdhdfhsdfh|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jfgjfr5jdfj.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0b|jfgjfr5jdfj|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secowo.com IMMORTAL (Malware_Distribution)"; content:"|06|secowo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secree.com IMMORTAL (Malware_Distribution)"; content:"|06|secree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uoauer.com IMMORTAL (Malware_Distribution)"; content:"|06|uoauer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-stat50.info IMMORTAL (Malware_Distribution)"; content:"|0d|google-stat50|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedfer.com IMMORTAL (Malware_Distribution)"; content:"|06|bedfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buypartylights.com IMMORTAL (Malware_Distribution)"; content:"|0e|buypartylights|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsdg2g32.co.cc IMMORTAL (Malware_Distribution)"; content:"|08|gsdg2g32|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hrh45jftjfj.co.cc IMMORTAL (Malware_Distribution)"; content:"|0b|hrh45jftjfj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jassportfolio.se IMMORTAL (Malware_Distribution)"; content:"|0d|jassportfolio|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jdownloaderitalia.netsons.org IMMORTAL (Malware_Distribution)"; content:"|11|jdownloaderitalia|07|netsons|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiralikasansorizmir.com IMMORTAL (Malware_Distribution)"; content:"|13|kiralikasansorizmir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kirm-sky.ru IMMORTAL (Malware_Distribution)"; content:"|08|kirm-sky|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kockoy.com IMMORTAL (Malware_Distribution)"; content:"|06|kockoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loveaz.biz IMMORTAL (Malware_Distribution)"; content:"|06|loveaz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pixforfree.net IMMORTAL (Malware_Distribution)"; content:"|0a|pixforfree|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup randomlegend.net IMMORTAL (Malware_Distribution)"; content:"|0c|randomlegend|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scaraori.com IMMORTAL (Malware_Distribution)"; content:"|08|scaraori|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexpot.co.kr IMMORTAL (Malware_Distribution)"; content:"|06|sexpot|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sgs.co.kr IMMORTAL (Malware_Distribution)"; content:"|03|sgs|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sho0oq.com IMMORTAL (Malware_Distribution)"; content:"|06|sho0oq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoba.in IMMORTAL (Malware_Distribution)"; content:"|05|shoba|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup showdevelopment.com IMMORTAL (Malware_Distribution)"; content:"|0f|showdevelopment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup squirrelbird.net IMMORTAL (Malware_Distribution)"; content:"|0c|squirrelbird|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crazymasya.com IMMORTAL (Malware_Distribution)"; content:"|0a|crazymasya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inlovebot.com IMMORTAL (Malware_Distribution)"; content:"|09|inlovebot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartenergymodel.com IMMORTAL (Malware_Infectors)"; content:"|10|smartenergymodel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup volgo-marun.cn IMMORTAL (Malware_Infectors)"; content:"|0b|volgo-marun|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corpadsinc.com IMMORTAL (Malware_Infectors)"; content:"|0a|corpadsinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 212156dnfgdn.co.cc IMMORTAL (Phishing_and_Theft)"; content:"|0c|212156dnfgdn|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsdg43hsweh.co.cc IMMORTAL (Phishing_and_Theft)"; content:"|0b|gsdg43hsweh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hairyartist.ru IMMORTAL (Malware_Distribution)"; content:"|0b|hairyartist|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hndfdfnfdnxdnf.vv.cc IMMORTAL (Phishing_and_Theft)"; content:"|0e|hndfdfnfdnxdnf|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hu587tiugi.vv.cc IMMORTAL (Phishing_and_Theft)"; content:"|0a|hu587tiugi|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lonelyzero.ru IMMORTAL (Malware_Distribution)"; content:"|0a|lonelyzero|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t6ryt56.info IMMORTAL (Spyware)"; content:"|07|t6ryt56|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup before-this-life.ru IMMORTAL (Malware_Distribution)"; content:"|10|before-this-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestage.ru IMMORTAL (Malware_Distribution)"; content:"|07|bestage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestbondsite.ru IMMORTAL (Malware_Distribution)"; content:"|0c|bestbondsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-age.ru IMMORTAL (Malware_Distribution)"; content:"|07|bio-age|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-free.ru IMMORTAL (Malware_Distribution)"; content:"|08|bio-free|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-oib.ru IMMORTAL (Malware_Distribution)"; content:"|07|bio-oib|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-tube.ru IMMORTAL (Malware_Distribution)"; content:"|08|bio-tube|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-z.ru IMMORTAL (Malware_Distribution)"; content:"|05|bio-z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inother.ru IMMORTAL (Malware_Distribution)"; content:"|07|inother|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mozg-testing.ru IMMORTAL (Malware_Distribution)"; content:"|0c|mozg-testing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mozgilla.ru IMMORTAL (Malware_Distribution)"; content:"|08|mozgilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pastanotherlife.ru IMMORTAL (Malware_Distribution)"; content:"|0f|pastanotherlife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recentmexico.ru IMMORTAL (Malware_Distribution)"; content:"|0c|recentmexico|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtydesk.ru IMMORTAL (Malware_Distribution)"; content:"|0a|realtydesk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onceworld.ru IMMORTAL (Malware_Distribution)"; content:"|09|onceworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bradinfo.org IMMORTAL (Malware_Distribution)"; content:"|08|bradinfo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopstudios.cn IMMORTAL (Malware_Distribution)"; content:"|0d|bigtopstudios|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daebang.or.kr IMMORTAL (Malware_Distribution)"; content:"|07|daebang|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-ads-13.info IMMORTAL (Malware_Distribution)"; content:"|08|e-ads-13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g23h2hfsdjh.co.cc IMMORTAL (Malware_Distribution)"; content:"|0b|g23h2hfsdjh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdsh4hsfhdsj.vv.cc IMMORTAL (Malware_Distribution)"; content:"|0c|hdsh4hsfhdsj|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hermosayasociados.com IMMORTAL (Malware_Distribution)"; content:"|11|hermosayasociados|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lustzucker.de IMMORTAL (Malware_Distribution)"; content:"|0a|lustzucker|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malinowyzdroj.com.pl IMMORTAL (Malware_Distribution)"; content:"|0d|malinowyzdroj|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paytraff.biz IMMORTAL (Malware_Distribution)"; content:"|08|paytraff|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phones4wow.com IMMORTAL (Malware_Distribution)"; content:"|0a|phones4wow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planutt.com IMMORTAL (Malware_Distribution)"; content:"|07|planutt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raufkhalid.com IMMORTAL (Malware_Distribution)"; content:"|0a|raufkhalid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usonlineguide.com IMMORTAL (Malware_Distribution)"; content:"|0d|usonlineguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcounter.ru IMMORTAL (Malware_Distribution)"; content:"|08|xcounter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodgirlsbadguys.com IMMORTAL (Malware_Infectors)"; content:"|10|goodgirlsbadguys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup calicutinternationalschool.com IMMORTAL (Malware_Distribution)"; content:"|1a|calicutinternationalschool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marazmatik3.in IMMORTAL (Malware_Infectors)"; content:"|0b|marazmatik3|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0catch.com IMMORTAL (Malware_Distribution)"; content:"|06|0catch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusys.ru IMMORTAL (Fake_AV)"; content:"|0b|antivirusys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benuoska.com IMMORTAL (Malware_Distribution)"; content:"|08|benuoska|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-server43.info IMMORTAL (Malware_Distribution)"; content:"|0f|google-server43|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainnetsoll.com IMMORTAL (Malware_Distribution)"; content:"|0b|mainnetsoll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tttaaattt.ru IMMORTAL (Malware_Distribution)"; content:"|09|tttaaattt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vcp-counter.com IMMORTAL (Malware_Distribution)"; content:"|0b|vcp-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findbigsoftpack.cn IMMORTAL (Malware_Distribution)"; content:"|0f|findbigsoftpack|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giantpremium.cn IMMORTAL (Malware_Distribution)"; content:"|0c|giantpremium|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mchawking.com IMMORTAL (Malware_Infectors)"; content:"|09|mchawking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fancycake.net IMMORTAL (Malware_Infectors)"; content:"|09|fancycake|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2all.net IMMORTAL (Malware_Distribution)"; content:"|04|2all|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 75a.net IMMORTAL (Malware_Distribution)"; content:"|03|75a|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 772268.com IMMORTAL (Malware_Distribution)"; content:"|06|772268|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 77276.com IMMORTAL (Malware_Distribution)"; content:"|05|77276|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adverter13.info IMMORTAL (Malware_Distribution)"; content:"|0a|adverter13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajantastationers.com IMMORTAL (Malware_Distribution)"; content:"|10|ajantastationers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allforyouonline.com IMMORTAL (Malware_Distribution)"; content:"|0f|allforyouonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup balatoninyelvitabor.eu IMMORTAL (Malware_Distribution)"; content:"|13|balatoninyelvitabor|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopfindsite.cn IMMORTAL (Malware_Distribution)"; content:"|0e|bigtopfindsite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackoutday.ca IMMORTAL (Malware_Distribution)"; content:"|0b|blackoutday|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blog-salopes.com IMMORTAL (Malware_Distribution)"; content:"|0c|blog-salopes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bloggingforprofitsecrets.com IMMORTAL (Malware_Distribution)"; content:"|18|bloggingforprofitsecrets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centatu.com IMMORTAL (Malware_Distribution)"; content:"|07|centatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup china-saws.com IMMORTAL (Malware_Distribution)"; content:"|0a|china-saws|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counnter.cn IMMORTAL (Malware_Distribution)"; content:"|08|counnter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dasharathbhagat.com IMMORTAL (Malware_Distribution)"; content:"|0f|dasharathbhagat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domain460009.com IMMORTAL (Malware_Distribution)"; content:"|0c|domain460009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup efradin.net IMMORTAL (Malware_Distribution)"; content:"|07|efradin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egyptfoods.com.eg IMMORTAL (Malware_Distribution)"; content:"|0a|egyptfoods|03|com|02|eg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electroncompany.ro IMMORTAL (Malware_Distribution)"; content:"|0f|electroncompany|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezadguf.net IMMORTAL (Malware_Distribution)"; content:"|07|ezadguf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezgmp.com IMMORTAL (Malware_Distribution)"; content:"|05|ezgmp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fancountblogger.com IMMORTAL (Malware_Distribution)"; content:"|0f|fancountblogger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferefr.com IMMORTAL (Malware_Distribution)"; content:"|06|ferefr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgnfdfthrv.bee.pl IMMORTAL (Malware_Distribution)"; content:"|0a|fgnfdfthrv|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filthyadserver.com IMMORTAL (Malware_Distribution)"; content:"|0e|filthyadserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freepetcaretips.com IMMORTAL (Malware_Distribution)"; content:"|0f|freepetcaretips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g4teilt.de IMMORTAL (Malware_Distribution)"; content:"|07|g4teilt|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gate4clicks.info IMMORTAL (Spyware)"; content:"|0b|gate4clicks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalmixgroup.cn IMMORTAL (Malware_Distribution)"; content:"|0e|globalmixgroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalnameshop.cn IMMORTAL (Malware_Distribution)"; content:"|0e|globalnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldtmu.info IMMORTAL (Malware_Distribution)"; content:"|07|goldtmu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup habrion.cn IMMORTAL (Malware_Distribution)"; content:"|07|habrion|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hadamilano.com IMMORTAL (Malware_Distribution)"; content:"|0a|hadamilano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hadishop.ir IMMORTAL (Malware_Distribution)"; content:"|08|hadishop|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harborlab.co.cc IMMORTAL (Malware_Distribution)"; content:"|09|harborlab|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hope2012.info IMMORTAL (Malware_Distribution)"; content:"|08|hope2012|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inexper.com IMMORTAL (Malware_Distribution)"; content:"|07|inexper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innovativepoly.com.au IMMORTAL (Malware_Distribution)"; content:"|0e|innovativepoly|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intzvill.com IMMORTAL (Malware_Distribution)"; content:"|08|intzvill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jinchunmarket.co.kr IMMORTAL (Malware_Distribution)"; content:"|0d|jinchunmarket|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joymineralcosmetics.com IMMORTAL (Malware_Distribution)"; content:"|13|joymineralcosmetics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup junaidandzia.com IMMORTAL (Malware_Distribution)"; content:"|0c|junaidandzia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kavur.com IMMORTAL (Malware_Distribution)"; content:"|05|kavur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kebsyno.com IMMORTAL (Malware_Distribution)"; content:"|07|kebsyno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kirmar.ru IMMORTAL (Malware_Distribution)"; content:"|06|kirmar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lageny.com IMMORTAL (Malware_Distribution)"; content:"|06|lageny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liteautogreatest.cn IMMORTAL (Malware_Distribution)"; content:"|10|liteautogreatest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lojadasflores.pt IMMORTAL (Malware_Distribution)"; content:"|0d|lojadasflores|02|pt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lsjrs.com IMMORTAL (Malware_Distribution)"; content:"|05|lsjrs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lubnays.cn IMMORTAL (Malware_Distribution)"; content:"|07|lubnays|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup machineclassic.com IMMORTAL (Malware_Distribution)"; content:"|0e|machineclassic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainoffer4you.com IMMORTAL (Malware_Distribution)"; content:"|0d|mainoffer4you|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manatki-moda.ru IMMORTAL (Malware_Distribution)"; content:"|0c|manatki-moda|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marchingbaby.com IMMORTAL (Malware_Distribution)"; content:"|0c|marchingbaby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediahousenamebuyvideo.cn IMMORTAL (Malware_Distribution)"; content:"|16|mediahousenamebuyvideo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miracledialer.com IMMORTAL (Malware_Distribution)"; content:"|0d|miracledialer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mjw.or.kr IMMORTAL (Malware_Distribution)"; content:"|03|mjw|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviecoupons.com IMMORTAL (Malware_Distribution)"; content:"|0c|moviecoupons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysterio.info IMMORTAL (Malware_Distribution)"; content:"|08|mysterio|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nameclaimstore.cn IMMORTAL (Malware_Distribution)"; content:"|0e|nameclaimstore|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nameforshop.cn IMMORTAL (Malware_Distribution)"; content:"|0b|nameforshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naveli.com IMMORTAL (Malware_Distribution)"; content:"|06|naveli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkvoicepromos.com IMMORTAL (Malware_Distribution)"; content:"|12|networkvoicepromos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt02.co.in IMMORTAL (Malware_Distribution)"; content:"|04|nt02|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuclear3.com IMMORTAL (Malware_Distribution)"; content:"|08|nuclear3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peopleopera.cn IMMORTAL (Malware_Distribution)"; content:"|0b|peopleopera|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pms.com.au IMMORTAL (Malware_Distribution)"; content:"|03|pms|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup postfolkovs.ru IMMORTAL (Malware_Distribution)"; content:"|0b|postfolkovs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premiumgolfmart.com IMMORTAL (Malware_Distribution)"; content:"|0f|premiumgolfmart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pwgegrsdfs.ru IMMORTAL (Malware_Distribution)"; content:"|0a|pwgegrsdfs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0a.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rantrafrout.com IMMORTAL (Spyware)"; content:"|0b|rantrafrout|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redirect-script.com IMMORTAL (Malware_Distribution)"; content:"|0f|redirect-script|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riotassistance.ru IMMORTAL (Malware_Distribution)"; content:"|0e|riotassistance|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rslinkgenerator.com IMMORTAL (Malware_Distribution)"; content:"|0f|rslinkgenerator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saspoo.com IMMORTAL (Malware_Distribution)"; content:"|06|saspoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secretstocredit.com IMMORTAL (Malware_Distribution)"; content:"|0f|secretstocredit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sedfer.com IMMORTAL (Malware_Distribution)"; content:"|06|sedfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup send29931.cn IMMORTAL (Malware_Distribution)"; content:"|09|send29931|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sglazu.net IMMORTAL (Malware_Distribution)"; content:"|06|sglazu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shindigz.info IMMORTAL (Malware_Distribution)"; content:"|08|shindigz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simonis-web.org IMMORTAL (Malware_Distribution)"; content:"|0b|simonis-web|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sochi.nov.ru IMMORTAL (Malware_Distribution)"; content:"|05|sochi|03|nov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soulinyou.ru IMMORTAL (Malware_Distribution)"; content:"|09|soulinyou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacecake.se IMMORTAL (Malware_Distribution)"; content:"|09|spacecake|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats-master11.info IMMORTAL (Malware_Distribution)"; content:"|0e|stats-master11|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taijijuan.ru IMMORTAL (Malware_Distribution)"; content:"|09|taijijuan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teleam.com IMMORTAL (Malware_Distribution)"; content:"|06|teleam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelotmachine.cn IMMORTAL (Malware_Distribution)"; content:"|0d|thelotmachine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thenetnameshop.cn IMMORTAL (Malware_Distribution)"; content:"|0e|thenetnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totaldid.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|totaldid|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradbox.net IMMORTAL (Malware_Distribution)"; content:"|07|tradbox|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tvoyatajna.msk.ru IMMORTAL (Malware_Distribution)"; content:"|0a|tvoyatajna|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verfer.com IMMORTAL (Malware_Distribution)"; content:"|06|verfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virgilrene.info IMMORTAL (Malware_Distribution)"; content:"|0a|virgilrene|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsmd.kz IMMORTAL (Malware_Distribution)"; content:"|04|vsmd|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webarh.com IMMORTAL (Malware_Distribution)"; content:"|06|webarh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup witcobber.com IMMORTAL (Malware_Distribution)"; content:"|09|witcobber|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldtruejournal.biz IMMORTAL (Malware_Distribution)"; content:"|10|worldtruejournal|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xedfer.com IMMORTAL (Malware_Distribution)"; content:"|06|xedfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yalovacimenemlak.com IMMORTAL (Malware_Distribution)"; content:"|10|yalovacimenemlak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourinsurancenow.info IMMORTAL (Malware_Distribution)"; content:"|10|yourinsurancenow|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourlitetop.cn IMMORTAL (Malware_Distribution)"; content:"|0b|yourlitetop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourpic.msk.ru IMMORTAL (Malware_Distribution)"; content:"|07|yourpic|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baxfer.com IMMORTAL (Malware_Distribution)"; content:"|06|baxfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kevfer.com IMMORTAL (Malware_Distribution)"; content:"|06|kevfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etnkorea.com IMMORTAL (Malware_Distribution)"; content:"|08|etnkorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kert9qw2.com IMMORTAL (Malware_Distribution)"; content:"|08|kert9qw2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 000cc.com IMMORTAL (Malware_Distribution)"; content:"|05|000cc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 13grandferi.ru IMMORTAL (Malware_Distribution)"; content:"|0b|13grandferi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 360doc.com IMMORTAL (Malware_Distribution)"; content:"|06|360doc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f4.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9365.org IMMORTAL (Malware_Distribution)"; content:"|04|9365|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adscomplete.info IMMORTAL (Malware_Distribution)"; content:"|0b|adscomplete|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advabnr.com IMMORTAL (Malware_Distribution)"; content:"|07|advabnr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alltuckedinathome.com IMMORTAL (Malware_Distribution)"; content:"|11|alltuckedinathome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup am4u.kr IMMORTAL (Malware_Distribution)"; content:"|04|am4u|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antistresser.com IMMORTAL (Malware_Distribution)"; content:"|0c|antistresser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atlasbicycles.com IMMORTAL (Malware_Distribution)"; content:"|0d|atlasbicycles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baragas-budd1.com IMMORTAL (Malware_Distribution)"; content:"|0d|baragas-budd1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup battop.ru IMMORTAL (Malware_Infectors)"; content:"|06|battop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedioger.com IMMORTAL (Malware_Distribution)"; content:"|08|bedioger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bevelli.com IMMORTAL (Malware_Distribution)"; content:"|07|bevelli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunssang.com IMMORTAL (Malware_Distribution)"; content:"|08|bunssang|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ctpatconsultants.com IMMORTAL (Malware_Distribution)"; content:"|10|ctpatconsultants|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fashionnails1.com IMMORTAL (Malware_Distribution)"; content:"|0d|fashionnails1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forredtag.ru IMMORTAL (Malware_Infectors)"; content:"|09|forredtag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup framtr.com IMMORTAL (Malware_Distribution)"; content:"|06|framtr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freepornii.com IMMORTAL (Malware_Distribution)"; content:"|0a|freepornii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuadrenal.com IMMORTAL (Malware_Distribution)"; content:"|09|fuadrenal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genuinehollywood.ru IMMORTAL (Malware_Infectors)"; content:"|10|genuinehollywood|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gharibola.ru IMMORTAL (Malware_Distribution)"; content:"|09|gharibola|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogo2me.net IMMORTAL (Malware_Distribution)"; content:"|07|gogo2me|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotnewguide.ru IMMORTAL (Malware_Infectors)"; content:"|0b|hotnewguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetcountercheck.com IMMORTAL (Malware_Distribution)"; content:"|14|internetcountercheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup landriver44.ru IMMORTAL (Malware_Distribution)"; content:"|0b|landriver44|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latebin.ru IMMORTAL (Malware_Distribution)"; content:"|07|latebin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup listage.info IMMORTAL (Malware_Distribution)"; content:"|07|listage|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livench.com IMMORTAL (Malware_Distribution)"; content:"|07|livench|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livesitedesign.ru IMMORTAL (Malware_Infectors)"; content:"|0e|livesitedesign|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m85853.com.cn IMMORTAL (Malware_Distribution)"; content:"|06|m85853|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup martuz.cn IMMORTAL (Malware_Distribution)"; content:"|06|martuz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediatagonline.ru IMMORTAL (Malware_Infectors)"; content:"|0e|mediatagonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup misfitsone.net IMMORTAL (Malware_Distribution)"; content:"|0a|misfitsone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnogobab.com IMMORTAL (Malware_Distribution)"; content:"|08|mnogobab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n85853.cn IMMORTAL (Malware_Distribution)"; content:"|06|n85853|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nakedbi.com IMMORTAL (Malware_Distribution)"; content:"|07|nakedbi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newagedirect.ru IMMORTAL (Malware_Infectors)"; content:"|0c|newagedirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odile-marco.com IMMORTAL (Malware_Distribution)"; content:"|0b|odile-marco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oeooea.com IMMORTAL (Malware_Distribution)"; content:"|06|oeooea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlyfind.net IMMORTAL (Malware_Distribution)"; content:"|08|onlyfind|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pocketbloke.ru IMMORTAL (Malware_Distribution)"; content:"|0b|pocketbloke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rnw.kz IMMORTAL (Malware_Distribution)"; content:"|03|rnw|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robertsaffiliatsprograms.net IMMORTAL (Malware_Distribution)"; content:"|18|robertsaffiliatsprograms|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopmovieproduction.cn IMMORTAL (Malware_Distribution)"; content:"|13|shopmovieproduction|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sina163.info IMMORTAL (Malware_Distribution)"; content:"|07|sina163|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sswelder.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|sswelder|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermicrotag.ru IMMORTAL (Malware_Infectors)"; content:"|0d|supermicrotag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelifetag.ru IMMORTAL (Malware_Infectors)"; content:"|0a|thelifetag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ustocn.com.cn IMMORTAL (Malware_Distribution)"; content:"|06|ustocn|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zkasbo.ru IMMORTAL (Malware_Distribution)"; content:"|06|zkasbo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup durnosy.com IMMORTAL (Malware_Infectors)"; content:"|07|durnosy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sevenseasexplorer.de IMMORTAL (Malware_Infectors)"; content:"|11|sevenseasexplorer|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sparkspk.com IMMORTAL (Malware_Infectors)"; content:"|08|sparkspk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thanhhoacpi.vn IMMORTAL (Malware_Infectors)"; content:"|0b|thanhhoacpi|02|vn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup base-jump.co.cc IMMORTAL (Malware_Distribution)"; content:"|09|base-jump|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hipsxpress.co.uk IMMORTAL (Malware_Distribution)"; content:"|0a|hipsxpress|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lernundsnej.com IMMORTAL (Malware_Distribution)"; content:"|0b|lernundsnej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profincorp.com IMMORTAL (Malware_Distribution)"; content:"|0a|profincorp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quality4service.com IMMORTAL (Malware_Distribution)"; content:"|0f|quality4service|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yandex-click.net IMMORTAL (Malware_Distribution)"; content:"|0c|yandex-click|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagequest360.com IMMORTAL (Malware_Distribution)"; content:"|0d|imagequest360|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup furniture-style.info IMMORTAL (Malware_Distribution)"; content:"|0f|furniture-style|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoo-statistic.com IMMORTAL (Malware_Distribution)"; content:"|0f|yahoo-statistic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g2hhfadh4ehfdh.co.cc IMMORTAL (Malware_Infectors)"; content:"|0e|g2hhfadh4ehfdh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdsg23gsgf.co.cc IMMORTAL (Malware_Infectors)"; content:"|0a|gdsg23gsgf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agreatindian.com IMMORTAL (Fake_AV)"; content:"|0c|agreatindian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aibsnleachq.in IMMORTAL (Fake_AV)"; content:"|0b|aibsnleachq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cqww88.com IMMORTAL (Fake_AV)"; content:"|06|cqww88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxgglm.com IMMORTAL (Fake_AV)"; content:"|06|cxgglm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktop-xp.com IMMORTAL (Fake_AV)"; content:"|0a|desktop-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalnames.net IMMORTAL (Fake_AV)"; content:"|0c|digitalnames|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enterteiment-wizrd.ru IMMORTAL (Fake_AV)"; content:"|12|enterteiment-wizrd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enterteimentwizrd.ru IMMORTAL (Fake_AV)"; content:"|11|enterteimentwizrd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everywoods.ru IMMORTAL (Fake_AV)"; content:"|0a|everywoods|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmojid.com IMMORTAL (Fake_AV)"; content:"|08|filmojid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaja79.com IMMORTAL (Fake_AV)"; content:"|06|gaja79|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loaninfoslive.com IMMORTAL (Fake_AV)"; content:"|0d|loaninfoslive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palliativepoonoor.org IMMORTAL (Fake_AV)"; content:"|11|palliativepoonoor|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smarttorich.com IMMORTAL (Fake_AV)"; content:"|0b|smarttorich|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tecros.ru IMMORTAL (Fake_AV)"; content:"|06|tecros|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thesiterush.com IMMORTAL (Fake_AV)"; content:"|0b|thesiterush|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tinypic.info IMMORTAL (Fake_AV)"; content:"|07|tinypic|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukad.com IMMORTAL (Fake_AV)"; content:"|04|ukad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolbarinc.com IMMORTAL (Malware_Infectors)"; content:"|0a|toolbarinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdsvps.in IMMORTAL ()"; content:"|06|vdsvps|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todosantivirusfree.com IMMORTAL (Fake_AV)"; content:"|12|todosantivirusfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amcupsite.com IMMORTAL (Malware_Distribution)"; content:"|09|amcupsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dianesomerville.co.uk IMMORTAL (Malware_Distribution)"; content:"|0f|dianesomerville|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kmqwe.in IMMORTAL (Malware_Distribution)"; content:"|05|kmqwe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 32tsdgseg.co.cc IMMORTAL (Malware_Distribution)"; content:"|09|32tsdgseg|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad100sdhjsd.com IMMORTAL (Malware_Distribution)"; content:"|0b|ad100sdhjsd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bacalawr.net IMMORTAL (Malware_Distribution)"; content:"|08|bacalawr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dullplane.ru IMMORTAL (Malware_Distribution)"; content:"|09|dullplane|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eftpsid0343233.ru IMMORTAL (Malware_Distribution)"; content:"|0e|eftpsid0343233|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finlinkonline.com IMMORTAL (Malware_Distribution)"; content:"|0d|finlinkonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freepicturebox.com IMMORTAL (Malware_Distribution)"; content:"|0e|freepicturebox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-stats44.info IMMORTAL (Malware_Distribution)"; content:"|0e|google-stats44|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-stats55.info IMMORTAL (Malware_Distribution)"; content:"|0e|google-stats55|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahablaururu.info IMMORTAL (Malware_Distribution)"; content:"|0c|hahablaururu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hbaehanfznjfh.co.cc IMMORTAL (Malware_Distribution)"; content:"|0d|hbaehanfznjfh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdh45hdxfhf.co.cc IMMORTAL (Malware_Distribution)"; content:"|0b|hdh45hdxfhf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hottiger.ru IMMORTAL (Malware_Distribution)"; content:"|08|hottiger|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joiojojo.in IMMORTAL (Malware_Distribution)"; content:"|08|joiojojo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kai-zellner.de IMMORTAL (Malware_Distribution)"; content:"|0b|kai-zellner|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statistics-cyberpank.co.cc IMMORTAL (Malware_Distribution)"; content:"|14|statistics-cyberpank|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xatarena.com IMMORTAL (Malware_Distribution)"; content:"|08|xatarena|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediahousenamemartmovie.cn IMMORTAL (Malware_Infectors)"; content:"|17|mediahousenamemartmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domsre.com IMMORTAL (Malware_Distribution)"; content:"|06|domsre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faimpazzireiragazzi.it IMMORTAL (Malware_Distribution)"; content:"|13|faimpazzireiragazzi|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjep.co.kr IMMORTAL (Malware_Distribution)"; content:"|04|kjep|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rthrwndda.bee.pl IMMORTAL (Malware_Distribution)"; content:"|09|rthrwndda|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup textcube.com IMMORTAL (Malware_Distribution)"; content:"|08|textcube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 128bitninja.com IMMORTAL (Malware_Distribution)"; content:"|0b|128bitninja|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analys.ru IMMORTAL (Malware_Distribution)"; content:"|06|analys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ardsigorta.com IMMORTAL (Malware_Distribution)"; content:"|0a|ardsigorta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigclarks.com IMMORTAL (Malware_Distribution)"; content:"|09|bigclarks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clifedo.net IMMORTAL (Malware_Distribution)"; content:"|07|clifedo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup farbaby.ru IMMORTAL (Malware_Distribution)"; content:"|07|farbaby|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gberbhjerfds.osa.pl IMMORTAL (Malware_Distribution)"; content:"|0c|gberbhjerfds|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gstats.cn IMMORTAL (Malware_Distribution)"; content:"|06|gstats|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hit-senders.cn IMMORTAL (Malware_Distribution)"; content:"|0b|hit-senders|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iexam.info IMMORTAL (Malware_Distribution)"; content:"|05|iexam|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgdownloads.com IMMORTAL (Malware_Distribution)"; content:"|0c|imgdownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup natebennettfleming.com IMMORTAL (Malware_Distribution)"; content:"|12|natebennettfleming|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neglite.com IMMORTAL (Malware_Distribution)"; content:"|07|neglite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seemoreshows.com IMMORTAL (Malware_Distribution)"; content:"|0c|seemoreshows|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sepi.tw IMMORTAL (Malware_Distribution)"; content:"|04|sepi|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theherbfarm.co.kr IMMORTAL (Malware_Distribution)"; content:"|0b|theherbfarm|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-counter-online.ru IMMORTAL (Malware_Distribution)"; content:"|12|web-counter-online|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yadr0.com IMMORTAL (Malware_Distribution)"; content:"|05|yadr0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yasarsigorta.com IMMORTAL (Malware_Distribution)"; content:"|0c|yasarsigorta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgaaa.net IMMORTAL (Malware_Infectors)"; content:"|06|imgaaa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lbook.org IMMORTAL (Malware_Distribution)"; content:"|05|lbook|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new.weincorping.info IMMORTAL (Malware_Infectors)"; content:"|03|new|0b|weincorping|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ediyhy.cn IMMORTAL (Malware_Distribution)"; content:"|06|ediyhy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajytse5.com IMMORTAL (Malware_Infectors)"; content:"|07|ajytse5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alf.inf.br IMMORTAL (Malware_Infectors)"; content:"|03|alf|03|inf|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dimsmoke.ru IMMORTAL (Malware_Distribution)"; content:"|08|dimsmoke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldcoinurl.com IMMORTAL (Malware_Infectors)"; content:"|0b|goldcoinurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goog1e-analytics.com IMMORTAL (Malware_Infectors)"; content:"|10|goog1e-analytics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatrow.ru IMMORTAL (Malware_Distribution)"; content:"|08|greatrow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup littlecommon.net IMMORTAL (Malware_Infectors)"; content:"|0c|littlecommon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup podgorz.org IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|07|podgorz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppcube.com IMMORTAL (Malware_Infectors)"; content:"|06|ppcube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redrt.org.in IMMORTAL (Spyware)"; content:"|05|redrt|03|org|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thingre.com IMMORTAL (Malware_Distribution)"; content:"|07|thingre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiredwolfhome.com IMMORTAL (Spyware)"; content:"|0d|tiredwolfhome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tourskorea.com IMMORTAL (Malware_Distribution)"; content:"|0a|tourskorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup translate-google-cache.com IMMORTAL (Malware_Infectors)"; content:"|16|translate-google-cache|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoowatch.co.tv IMMORTAL (Malware_Infectors)"; content:"|0b|videoowatch|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirus021.com IMMORTAL (Fake_AV)"; content:"|10|web-antivirus021|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowshopworld.com IMMORTAL (Malware_Infectors)"; content:"|0f|windowshopworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwzapas.cn IMMORTAL (Malware_Distribution)"; content:"|08|wwwzapas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgddd.net IMMORTAL (Malware_Distribution)"; content:"|06|imgddd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paleenem.com IMMORTAL (Malware_Distribution)"; content:"|08|paleenem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scornar.com IMMORTAL (Malware_Distribution)"; content:"|07|scornar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theboehringers.com IMMORTAL (Spyware)"; content:"|0e|theboehringers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-online90.com IMMORTAL (Fake_AV)"; content:"|10|antispy-online90|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-online90.com IMMORTAL (Fake_AV)"; content:"|14|antispyware-online90|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online21.com IMMORTAL (Fake_AV)"; content:"|12|antivirus-online21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online31.com IMMORTAL (Fake_AV)"; content:"|12|antivirus-online31|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online51.com IMMORTAL (Fake_AV)"; content:"|12|antivirus-online51|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online71.com IMMORTAL (Fake_AV)"; content:"|12|antivirus-online71|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovegreenstreet.com IMMORTAL (Spyware)"; content:"|0f|lovegreenstreet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prerre.com IMMORTAL (Malware_Distribution)"; content:"|06|prerre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2288.org IMMORTAL (Malware_Distribution)"; content:"|04|2288|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourblenderparts.ru IMMORTAL (Malware_Infectors)"; content:"|10|yourblenderparts|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestnewsmall.ru IMMORTAL (Malware_Infectors)"; content:"|0c|bestnewsmall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestnewhaven.ru IMMORTAL (Malware_Distribution)"; content:"|0c|bestnewhaven|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homecarenation.ru IMMORTAL (Malware_Infectors)"; content:"|0e|homecarenation|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newgolfonline.ru IMMORTAL (Malware_Infectors)"; content:"|0d|newgolfonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsourceworld.ru IMMORTAL (Malware_Infectors)"; content:"|0e|newsourceworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redtagcentral.ru IMMORTAL (Malware_Infectors)"; content:"|0d|redtagcentral|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samuest.ru IMMORTAL (Malware_Infectors)"; content:"|07|samuest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supernewstuff.ru IMMORTAL (Malware_Infectors)"; content:"|0d|supernewstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtagheuer.ru IMMORTAL (Malware_Infectors)"; content:"|0c|yourtagheuer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2d7d.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|2d7d|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3dk1.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|3dk1|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 71pp.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|71pp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 945e.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|945e|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f2hl.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|f2hl|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtha.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|gtha|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f7p.ru IMMORTAL (Malware_Distribution)"; content:"|03|f7p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup davtraff.com IMMORTAL (Malware_Infectors)"; content:"|08|davtraff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yenguide.com IMMORTAL (Malware_Distribution)"; content:"|08|yenguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup losotrana.com IMMORTAL (Malware_Infectors)"; content:"|09|losotrana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pprom.ru IMMORTAL (Malware_Infectors)"; content:"|05|pprom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rogerk.us IMMORTAL (Malware_Infectors)"; content:"|06|rogerk|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundstorm.com IMMORTAL (Malware_Infectors)"; content:"|0a|roundstorm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panasonic-tv.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0c|panasonic-tv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insomniaboldinfoorg.com IMMORTAL (Malware_Distribution)"; content:"|13|insomniaboldinfoorg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myyes104.com IMMORTAL (Malware_Distribution)"; content:"|08|myyes104|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dacenete.com IMMORTAL (Malware_Distribution)"; content:"|08|dacenete|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chura.pl IMMORTAL (Malware_Distribution)"; content:"|05|chura|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amd-creations.com IMMORTAL (Malware_Distribution)"; content:"|0d|amd-creations|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqarat-ksa.com IMMORTAL (Malware_Distribution)"; content:"|0a|aqarat-ksa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogdetranssexuel.com IMMORTAL (Malware_Distribution)"; content:"|11|blogdetranssexuel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doub1eclick.net IMMORTAL (Malware_Distribution)"; content:"|0b|doub1eclick|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eseducation.co.kr IMMORTAL (Malware_Distribution)"; content:"|0b|eseducation|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golfmorocco.com IMMORTAL (Malware_Distribution)"; content:"|0b|golfmorocco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsmpayphone.com IMMORTAL (Malware_Distribution)"; content:"|0b|gsmpayphone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup integratedidea.com IMMORTAL (Malware_Distribution)"; content:"|0e|integratedidea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khandagiridevelopers.com IMMORTAL (Malware_Distribution)"; content:"|14|khandagiridevelopers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marchex.com IMMORTAL (Malware_Distribution)"; content:"|07|marchex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmtrf.com IMMORTAL (Malware_Distribution)"; content:"|05|mmtrf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtxa.net IMMORTAL (Malware_Distribution)"; content:"|04|mtxa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mwonline.info IMMORTAL (Malware_Distribution)"; content:"|08|mwonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfucking-pussy.com IMMORTAL (Malware_Distribution)"; content:"|0f|myfucking-pussy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mykasker.com IMMORTAL (Malware_Distribution)"; content:"|08|mykasker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relax-july.ru IMMORTAL (Malware_Distribution)"; content:"|0a|relax-july|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrezrel.co.cc IMMORTAL (Malware_Distribution)"; content:"|07|rrezrel|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simonrojas.com IMMORTAL (Malware_Distribution)"; content:"|0a|simonrojas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sugarncream.ivyro.net IMMORTAL (Malware_Distribution)"; content:"|0b|sugarncream|05|ivyro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersplittester.com IMMORTAL (Malware_Distribution)"; content:"|10|supersplittester|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taktiku.biz IMMORTAL (Malware_Distribution)"; content:"|07|taktiku|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-websharing.com IMMORTAL (Malware_Distribution)"; content:"|0e|top-websharing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toxicham.ru IMMORTAL (Malware_Distribution)"; content:"|08|toxicham|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup walesedu.com IMMORTAL (Malware_Distribution)"; content:"|08|walesedu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findbigbearproperty.cn IMMORTAL (SEO_Fraud)"; content:"|13|findbigbearproperty|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itra.cn IMMORTAL (Fake_AV)"; content:"|04|itra|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kuaiche.com IMMORTAL (Fake_AV)"; content:"|07|kuaiche|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kuailv.com IMMORTAL (Fake_AV)"; content:"|06|kuailv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ledcac.com IMMORTAL (Fake_AV)"; content:"|06|ledcac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nimp.org IMMORTAL (Fake_AV)"; content:"|04|nimp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup payam.nu IMMORTAL (Fake_AV)"; content:"|05|payam|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup henshiwuliao.com IMMORTAL (Malware_Distribution)"; content:"|0c|henshiwuliao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup red-wolf.ru IMMORTAL (Malware_Distribution)"; content:"|08|red-wolf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addonrock.ru IMMORTAL (Malware_Distribution)"; content:"|09|addonrock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup step2me.net IMMORTAL (Malware_Distribution)"; content:"|07|step2me|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4e4en.com IMMORTAL (Spyware)"; content:"|05|4e4en|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namethatshop.cn IMMORTAL (Spyware)"; content:"|0c|namethatshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghura.pl IMMORTAL (Malware_Infectors)"; content:"|05|ghura|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumblar.cn IMMORTAL (Malware_Distribution)"; content:"|07|gumblar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afonya123.com IMMORTAL (Botnet_C&C)"; content:"|09|afonya123|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sadkajt357.com IMMORTAL (Malware_Distribution)"; content:"|0a|sadkajt357|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolbarcom.org IMMORTAL (Malware_Distribution)"; content:"|0a|toolbarcom|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 318x.com IMMORTAL (Malware_Distribution)"; content:"|04|318x|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acrossuniverseitbenet.com IMMORTAL (Spyware)"; content:"|15|acrossuniverseitbenet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sol-stats.info IMMORTAL (Malware_Infectors)"; content:"|09|sol-stats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoefra.at IMMORTAL (Malware_Distribution)"; content:"|06|hoefra|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaquemet-zehnder.ch IMMORTAL (Malware_Distribution)"; content:"|10|jaquemet-zehnder|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pubetter.dk IMMORTAL (Malware_Distribution)"; content:"|08|pubetter|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easychurch.ru IMMORTAL (Malware_Distribution)"; content:"|0a|easychurch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delhicakesngifts.com IMMORTAL (Malware_Distribution)"; content:"|10|delhicakesngifts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emrahkeskin.com IMMORTAL (Malware_Distribution)"; content:"|0b|emrahkeskin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innkeyhr.net IMMORTAL (Malware_Distribution)"; content:"|08|innkeyhr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msnupdateserver.info IMMORTAL (Malware_Distribution)"; content:"|0f|msnupdateserver|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rollingwithrubicon.com IMMORTAL (Malware_Distribution)"; content:"|12|rollingwithrubicon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup water4health.com IMMORTAL (Malware_Distribution)"; content:"|0c|water4health|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpointenemy.com IMMORTAL (Malware_Distribution)"; content:"|0b|xpointenemy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopmoviefestival.cn IMMORTAL (Malware_Distribution)"; content:"|11|shopmoviefestival|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thekapita.com IMMORTAL (Malware_Distribution)"; content:"|09|thekapita|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krclear.com IMMORTAL (Malware_Distribution)"; content:"|07|krclear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trenz.pl IMMORTAL (Malware_Distribution)"; content:"|05|trenz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combinebet.cn IMMORTAL (Malware_Distribution)"; content:"|0a|combinebet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gianttopdiscover.cn IMMORTAL (Malware_Distribution)"; content:"|10|gianttopdiscover|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litetopfindworld.cn IMMORTAL (Malware_Distribution)"; content:"|10|litetopfindworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newnetnameshop.cn IMMORTAL (Malware_Distribution)"; content:"|0e|newnetnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parkinglotbet.cn IMMORTAL (Malware_Distribution)"; content:"|0d|parkinglotbet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premiumlocate.cn IMMORTAL (Malware_Distribution)"; content:"|0d|premiumlocate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5x.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestwaytofind.cn IMMORTAL (Malware_Distribution)"; content:"|10|thebestwaytofind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizaue.com IMMORTAL (Malware_Infectors)"; content:"|06|bizaue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ripubcc.com IMMORTAL (Malware_Infectors)"; content:"|07|ripubcc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 08zs.com IMMORTAL (Malware_Distribution)"; content:"|04|08zs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1speed.info IMMORTAL (Spyware)"; content:"|06|1speed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2112111.com IMMORTAL (Malware_Distribution)"; content:"|07|2112111|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutheatergroup.cn IMMORTAL (Malware_Distribution)"; content:"|0e|cutheatergroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dashbulag.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|09|dashbulag|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findbigmoneygame.cn IMMORTAL (Malware_Distribution)"; content:"|10|findbigmoneygame|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatnamemovie.cn IMMORTAL (Malware_Distribution)"; content:"|0e|greatnamemovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuttypiano.com IMMORTAL (Malware_Distribution)"; content:"|0a|nuttypiano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oceandealer.cn IMMORTAL (Malware_Distribution)"; content:"|0b|oceandealer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pamiangsao.com IMMORTAL (Malware_Distribution)"; content:"|0a|pamiangsao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pkgmitom.ru IMMORTAL (Malware_Distribution)"; content:"|08|pkgmitom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robints.us IMMORTAL (Malware_Distribution)"; content:"|07|robints|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sites-counter.com IMMORTAL (Malware_Distribution)"; content:"|0d|sites-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup support.orti.free.fr IMMORTAL (Malware_Distribution)"; content:"|07|support|04|orti|04|free|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t-e-clive.com IMMORTAL (Malware_Distribution)"; content:"|09|t-e-clive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taogu.org.cn IMMORTAL (Malware_Distribution)"; content:"|05|taogu|03|org|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyrolerfesten.se IMMORTAL (Malware_Distribution)"; content:"|0d|tyrolerfesten|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7o8.net IMMORTAL (Malware_Distribution)"; content:"|03|7o8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abbcp.cn IMMORTAL (Malware_Distribution)"; content:"|05|abbcp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbsr.co.in IMMORTAL (Malware_Distribution)"; content:"|04|bbsr|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letterssite.ru IMMORTAL (SEO_Fraud)"; content:"|0b|letterssite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifedrom.ru IMMORTAL (SEO_Fraud)"; content:"|08|lifedrom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamj.ru IMMORTAL (Malware_Distribution)"; content:"|04|mamj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newlifeworld.ru IMMORTAL (SEO_Fraud)"; content:"|0c|newlifeworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zenitchampion.cn IMMORTAL (Malware_Distribution)"; content:"|0d|zenitchampion|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kvarteretekorren.se IMMORTAL (Malware_Distribution)"; content:"|10|kvarteretekorren|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwvv.us IMMORTAL (Malware_Distribution)"; content:"|04|wwvv|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logisticservices.info IMMORTAL (Malware_Distribution)"; content:"|10|logisticservices|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storeoffers.info IMMORTAL (Malware_Distribution)"; content:"|0b|storeoffers|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stratix.info IMMORTAL (Malware_Distribution)"; content:"|07|stratix|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cathrynzfunz.com IMMORTAL (Phishing_and_Theft)"; content:"|0c|cathrynzfunz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gcounter.cn IMMORTAL (Malware_Distribution)"; content:"|08|gcounter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portaln.info IMMORTAL (Malware_Distribution)"; content:"|07|portaln|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domain454002.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0c|domain454002|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rentsatoday.com IMMORTAL (Botnet_C&C)"; content:"|0b|rentsatoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smert-test.ru IMMORTAL (Malware_Infectors)"; content:"|0a|smert-test|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sockslab.net IMMORTAL (Malware_Distribution)"; content:"|08|sockslab|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sphusa.com IMMORTAL (Botnet_C&C)"; content:"|06|sphusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup splitssoft.com IMMORTAL (Malware_Infectors)"; content:"|0a|splitssoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toppulse32.org IMMORTAL (Malware_Infectors)"; content:"|0a|toppulse32|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5r.ru IMMORTAL (Malware_Distribution)"; content:"|03|b5r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b7p.ru IMMORTAL (Malware_Distribution)"; content:"|03|b7p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b9g.at IMMORTAL (Malware_Distribution)"; content:"|03|b9g|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tytowax.info IMMORTAL (Malware_Infectors)"; content:"|07|tytowax|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bastakigroup.com IMMORTAL (Botnet_C&C)"; content:"|0c|bastakigroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qatar-business-guide.net IMMORTAL (Botnet_C&C)"; content:"|14|qatar-business-guide|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-stats50.info IMMORTAL (Malware_Distribution)"; content:"|0e|google-stats50|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aweleon.com IMMORTAL (Malware_Distribution)"; content:"|07|aweleon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pantali.com IMMORTAL (Malware_Distribution)"; content:"|07|pantali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigsophieblog.com IMMORTAL (Malware_Infectors)"; content:"|0d|bigsophieblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dragongut.co.cc IMMORTAL (Malware_Infectors)"; content:"|09|dragongut|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maniyakat.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|09|maniyakat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 09cd.co.kr IMMORTAL (Malware_Distribution)"; content:"|04|09cd|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afrique-solidarite.org IMMORTAL (Malware_Distribution)"; content:"|12|afrique-solidarite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alexander-ditz.de IMMORTAL (Malware_Distribution)"; content:"|0e|alexander-ditz|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apadanagroups.ir IMMORTAL (Malware_Distribution)"; content:"|0d|apadanagroups|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arekosicki.com IMMORTAL (Malware_Distribution)"; content:"|0a|arekosicki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artalepwellness.com IMMORTAL (Malware_Distribution)"; content:"|0f|artalepwellness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup at1.it IMMORTAL (Malware_Distribution)"; content:"|03|at1|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atelieray.com IMMORTAL (Malware_Distribution)"; content:"|09|atelieray|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bangkokfood.com IMMORTAL (Malware_Distribution)"; content:"|0b|bangkokfood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bantontan.com IMMORTAL (Malware_Distribution)"; content:"|09|bantontan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baseballcardcatalog.com IMMORTAL (Malware_Distribution)"; content:"|13|baseballcardcatalog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baydem.com IMMORTAL (Malware_Distribution)"; content:"|06|baydem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellsdirectory.com IMMORTAL (Malware_Distribution)"; content:"|0e|bellsdirectory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellsworld.com IMMORTAL (Malware_Distribution)"; content:"|0a|bellsworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizcardcolor.com IMMORTAL (Malware_Distribution)"; content:"|0c|bizcardcolor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackhollywoodhu.com IMMORTAL (Malware_Distribution)"; content:"|10|blackhollywoodhu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blschd.com IMMORTAL (Malware_Distribution)"; content:"|06|blschd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blythe.la IMMORTAL (Malware_Distribution)"; content:"|06|blythe|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bobscopy.ca IMMORTAL (Malware_Distribution)"; content:"|08|bobscopy|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookav.net IMMORTAL (Malware_Distribution)"; content:"|06|bookav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bransonblast.com IMMORTAL (Malware_Distribution)"; content:"|0c|bransonblast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brightspacedehradun.com IMMORTAL (Malware_Distribution)"; content:"|13|brightspacedehradun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casamango.freehostia.com IMMORTAL (Malware_Distribution)"; content:"|09|casamango|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbx-north.se IMMORTAL (Malware_Distribution)"; content:"|09|cbx-north|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chartinfo.net IMMORTAL (Malware_Distribution)"; content:"|09|chartinfo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clavosdecristo.es IMMORTAL (Malware_Distribution)"; content:"|0e|clavosdecristo|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cologne-mohair-dyers.com IMMORTAL (Malware_Distribution)"; content:"|14|cologne-mohair-dyers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compfuture.net IMMORTAL (Malware_Distribution)"; content:"|0a|compfuture|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup culturechine.org IMMORTAL (Malware_Distribution)"; content:"|0c|culturechine|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup day-sity.ho.ua IMMORTAL (Malware_Distribution)"; content:"|08|day-sity|02|ho|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dayspaxalapa.com IMMORTAL (Malware_Distribution)"; content:"|0c|dayspaxalapa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbabasics.com IMMORTAL (Malware_Distribution)"; content:"|09|dbabasics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demkarklima.com IMMORTAL (Malware_Distribution)"; content:"|0b|demkarklima|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup denisen.com.cn IMMORTAL (Malware_Distribution)"; content:"|07|denisen|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup designrj.com IMMORTAL (Malware_Distribution)"; content:"|08|designrj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deutscheshaus.ge IMMORTAL (Malware_Distribution)"; content:"|0d|deutscheshaus|02|ge"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamonstar.cn IMMORTAL (Malware_Distribution)"; content:"|0a|diamonstar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup divineinnovation.net IMMORTAL (Malware_Distribution)"; content:"|10|divineinnovation|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donjanhealth.com IMMORTAL (Malware_Distribution)"; content:"|0c|donjanhealth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drakken.com.ar IMMORTAL (Malware_Distribution)"; content:"|07|drakken|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebi-live-chat.net IMMORTAL (Malware_Distribution)"; content:"|0d|ebi-live-chat|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egrocoffeetr.com IMMORTAL (Malware_Distribution)"; content:"|0c|egrocoffeetr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elaheh.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|06|elaheh|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elizabethdschafer.com IMMORTAL (Malware_Distribution)"; content:"|11|elizabethdschafer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emuna.com.ua IMMORTAL (Malware_Distribution)"; content:"|05|emuna|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup englishrescue.com IMMORTAL (Malware_Distribution)"; content:"|0d|englishrescue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erapost.net IMMORTAL (Malware_Distribution)"; content:"|07|erapost|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewela.co.kr IMMORTAL (Malware_Distribution)"; content:"|05|ewela|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expresshomecinema.com IMMORTAL (Malware_Distribution)"; content:"|11|expresshomecinema|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fashiontouch.net IMMORTAL (Malware_Distribution)"; content:"|0c|fashiontouch|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup felipeycamila.com.ar IMMORTAL (Malware_Distribution)"; content:"|0d|felipeycamila|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferozkhan.in IMMORTAL (Malware_Distribution)"; content:"|09|ferozkhan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferrytopia.com IMMORTAL (Malware_Distribution)"; content:"|0a|ferrytopia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup focusonesthetics.com IMMORTAL (Malware_Distribution)"; content:"|10|focusonesthetics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup folkartist-kr.com IMMORTAL (Malware_Distribution)"; content:"|0d|folkartist-kr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeviewbooks.tk IMMORTAL (Malware_Distribution)"; content:"|0d|freeviewbooks|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funkyclients.nl IMMORTAL (Malware_Distribution)"; content:"|0c|funkyclients|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g12.ro IMMORTAL (Malware_Distribution)"; content:"|03|g12|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gadgetsshore.com IMMORTAL (Malware_Distribution)"; content:"|0c|gadgetsshore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galleparadise.com IMMORTAL (Malware_Distribution)"; content:"|0d|galleparadise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gang.dothome.co.kr IMMORTAL (Malware_Distribution)"; content:"|04|gang|07|dothome|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlevirustemizleme.com IMMORTAL (Fake_AV)"; content:"|14|googlevirustemizleme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorselankara.com IMMORTAL (Malware_Distribution)"; content:"|0c|gorselankara|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grameendev.org IMMORTAL (Malware_Distribution)"; content:"|0a|grameendev|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup graphicmanagementassociates.com IMMORTAL (Malware_Distribution)"; content:"|1b|graphicmanagementassociates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gratisthumbs.com IMMORTAL (Malware_Distribution)"; content:"|0c|gratisthumbs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hickorys.ca IMMORTAL (Malware_Distribution)"; content:"|08|hickorys|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hindustanrealtyservices.com IMMORTAL (Malware_Distribution)"; content:"|17|hindustanrealtyservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopelife.in IMMORTAL (Malware_Distribution)"; content:"|08|hopelife|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hvsat6.freehostia.com IMMORTAL (Malware_Distribution)"; content:"|06|hvsat6|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup immo-bulgaria.de IMMORTAL (Malware_Distribution)"; content:"|0d|immo-bulgaria|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup incomltd.com IMMORTAL (Malware_Distribution)"; content:"|08|incomltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup industrialsurquillo.com IMMORTAL (Malware_Distribution)"; content:"|13|industrialsurquillo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infograph.com.mx IMMORTAL (Malware_Distribution)"; content:"|09|infograph|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipac-bd.org IMMORTAL (Malware_Distribution)"; content:"|07|ipac-bd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iris2009.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|iris2009|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup islacontoymexico.info IMMORTAL (Malware_Distribution)"; content:"|10|islacontoymexico|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itillc.com IMMORTAL (Malware_Distribution)"; content:"|06|itillc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup japimen.net IMMORTAL (Malware_Distribution)"; content:"|07|japimen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetaimesuit.com IMMORTAL (Malware_Distribution)"; content:"|0b|jetaimesuit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joeburns.eu IMMORTAL (Malware_Distribution)"; content:"|08|joeburns|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johnbennett.com IMMORTAL (Malware_Distribution)"; content:"|0b|johnbennett|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joy-leports.com IMMORTAL (Malware_Distribution)"; content:"|0b|joy-leports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jubilantmattresses.com IMMORTAL (Malware_Distribution)"; content:"|12|jubilantmattresses|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kadalcok.net IMMORTAL (Malware_Distribution)"; content:"|08|kadalcok|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kadikoyanaokulu.info IMMORTAL (Malware_Distribution)"; content:"|0f|kadikoyanaokulu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kandilkoy.com IMMORTAL (Malware_Distribution)"; content:"|09|kandilkoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kb40.com IMMORTAL (Malware_Distribution)"; content:"|04|kb40|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcom-m.com IMMORTAL (Malware_Distribution)"; content:"|06|kcom-m|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kfcf.co.kr IMMORTAL (Malware_Distribution)"; content:"|04|kfcf|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khezri-adine.ir IMMORTAL (Malware_Distribution)"; content:"|0c|khezri-adine|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kohyao.net IMMORTAL (Malware_Distribution)"; content:"|06|kohyao|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kortvideohem.se IMMORTAL (Malware_Distribution)"; content:"|0c|kortvideohem|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kyosoft.net IMMORTAL (Malware_Distribution)"; content:"|07|kyosoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l-n-a.co.uk IMMORTAL (Malware_Distribution)"; content:"|05|l-n-a|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lagule.at IMMORTAL (Malware_Distribution)"; content:"|06|lagule|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lauwaert.net IMMORTAL (Malware_Distribution)"; content:"|08|lauwaert|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leksakskungen.se IMMORTAL (Malware_Distribution)"; content:"|0d|leksakskungen|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifeinsurancequestions.info IMMORTAL (Malware_Distribution)"; content:"|16|lifeinsurancequestions|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lordrizzo.com IMMORTAL (Malware_Distribution)"; content:"|09|lordrizzo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maaandhra.com IMMORTAL (Malware_Distribution)"; content:"|09|maaandhra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mallcom.co.kr IMMORTAL (Malware_Distribution)"; content:"|07|mallcom|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mashaei.ir IMMORTAL (Malware_Distribution)"; content:"|07|mashaei|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mesgurukula.com IMMORTAL (Malware_Distribution)"; content:"|0b|mesgurukula|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metroeple.com IMMORTAL (Malware_Distribution)"; content:"|09|metroeple|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobilisim.mobi IMMORTAL (Malware_Distribution)"; content:"|09|mobilisim|04|mobi"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3-muza.pl IMMORTAL (Malware_Distribution)"; content:"|08|mp3-muza|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n-able.in IMMORTAL (Malware_Distribution)"; content:"|06|n-able|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nimaabedi.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|09|nimaabedi|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nimsaa.com IMMORTAL (Malware_Distribution)"; content:"|06|nimsaa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nongluck.com IMMORTAL (Malware_Distribution)"; content:"|08|nongluck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntoos.com IMMORTAL (Malware_Distribution)"; content:"|05|ntoos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup o0w0o.com IMMORTAL (Malware_Distribution)"; content:"|05|o0w0o|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okgrupo.com IMMORTAL (Malware_Distribution)"; content:"|07|okgrupo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oneindia.biz IMMORTAL (Malware_Distribution)"; content:"|08|oneindia|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orbitalenhancements.com IMMORTAL (Malware_Distribution)"; content:"|13|orbitalenhancements|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orhaninsaatltd.com IMMORTAL (Malware_Distribution)"; content:"|0e|orhaninsaatltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panamaxexim.com IMMORTAL (Malware_Distribution)"; content:"|0b|panamaxexim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pannatex.com IMMORTAL (Malware_Distribution)"; content:"|08|pannatex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petplant.hu IMMORTAL (Malware_Distribution)"; content:"|08|petplant|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup picafierce.com IMMORTAL (Malware_Distribution)"; content:"|0a|picafierce|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pin98.dothome.co.kr IMMORTAL (Malware_Distribution)"; content:"|05|pin98|07|dothome|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ponysirindhorn.com IMMORTAL (Malware_Distribution)"; content:"|0e|ponysirindhorn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poze.sloris.ro IMMORTAL (Malware_Distribution)"; content:"|04|poze|06|sloris|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup primobit.com IMMORTAL (Malware_Distribution)"; content:"|08|primobit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup propertyadvancement.com IMMORTAL (Malware_Distribution)"; content:"|13|propertyadvancement|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psgtech72.com IMMORTAL (Malware_Distribution)"; content:"|09|psgtech72|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup purunsj.com IMMORTAL (Malware_Distribution)"; content:"|07|purunsj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qvevri.ge IMMORTAL (Malware_Distribution)"; content:"|06|qvevri|02|ge"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radiorocks.kiev.ua IMMORTAL (Malware_Distribution)"; content:"|0a|radiorocks|04|kiev|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rajzdravi.cz IMMORTAL (Malware_Distribution)"; content:"|09|rajzdravi|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sakarya-vho.org IMMORTAL (Malware_Distribution)"; content:"|0b|sakarya-vho|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup speedklicker.de IMMORTAL (Malware_Distribution)"; content:"|0c|speedklicker|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swineflu-articles.com IMMORTAL (Malware_Distribution)"; content:"|11|swineflu-articles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tacsw.or.kr IMMORTAL (Malware_Distribution)"; content:"|05|tacsw|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamiltouch.com IMMORTAL (Malware_Distribution)"; content:"|0a|tamiltouch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teh-g.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|05|teh-g|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tem97.org IMMORTAL (Malware_Distribution)"; content:"|05|tem97|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theflyingpoodles.com IMMORTAL (Malware_Distribution)"; content:"|10|theflyingpoodles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thuonghuyenbooks.vn IMMORTAL (Malware_Distribution)"; content:"|10|thuonghuyenbooks|02|vn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tomo7e.com IMMORTAL (Malware_Distribution)"; content:"|06|tomo7e|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tvindc.com IMMORTAL (Malware_Distribution)"; content:"|06|tvindc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typicaldesign.net IMMORTAL (Malware_Distribution)"; content:"|0d|typicaldesign|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ugurkargonakliyat.com IMMORTAL (Malware_Distribution)"; content:"|11|ugurkargonakliyat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valleyseve.de IMMORTAL (Malware_Distribution)"; content:"|0a|valleyseve|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vankami.net IMMORTAL (Malware_Distribution)"; content:"|07|vankami|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup versaillesstudio.com IMMORTAL (Malware_Distribution)"; content:"|10|versaillesstudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viamediasolutions.com IMMORTAL (Malware_Distribution)"; content:"|11|viamediasolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidaabundanteheredia.pablohost.com IMMORTAL (Malware_Distribution)"; content:"|14|vidaabundanteheredia|09|pablohost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vikinginfotech.com IMMORTAL (Malware_Distribution)"; content:"|0e|vikinginfotech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup villadepinto.com IMMORTAL (Malware_Distribution)"; content:"|0c|villadepinto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waa.pl IMMORTAL (Malware_Distribution)"; content:"|03|waa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup walnut.la IMMORTAL (Malware_Distribution)"; content:"|06|walnut|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wapika.sitefr.info IMMORTAL (Malware_Distribution)"; content:"|06|wapika|06|sitefr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webdogs.nl IMMORTAL (Malware_Distribution)"; content:"|07|webdogs|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wepro-fashions.com IMMORTAL (Malware_Distribution)"; content:"|0e|wepro-fashions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wolfsclassiccarrent.nl IMMORTAL (Malware_Distribution)"; content:"|13|wolfsclassiccarrent|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wolfshop.pl IMMORTAL (Malware_Distribution)"; content:"|08|wolfshop|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zealups.com IMMORTAL (Malware_Distribution)"; content:"|07|zealups|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1k.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1m.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1n.in IMMORTAL (Malware_Distribution)"; content:"|03|q1n|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1u.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q40.ru IMMORTAL (Malware_Distribution)"; content:"|03|q40|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5a.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5c.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5l.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5u.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5v.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5y.in IMMORTAL (Malware_Distribution)"; content:"|03|q5y|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0r.in IMMORTAL (Malware_Distribution)"; content:"|03|u0r|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0s.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0s|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0t.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u19.in IMMORTAL (Malware_Distribution)"; content:"|03|u19|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1j.in IMMORTAL (Malware_Distribution)"; content:"|03|u1j|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1l.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5d.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5l.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5w.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6c.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7g.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7o.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7z.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9a.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9i.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0a.in IMMORTAL (Malware_Distribution)"; content:"|03|x0a|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x1g.in IMMORTAL (Malware_Distribution)"; content:"|03|x1g|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3v.in IMMORTAL (Malware_Distribution)"; content:"|03|x3v|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x5o.ru IMMORTAL (Malware_Distribution)"; content:"|03|x5o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6i.ru IMMORTAL (Malware_Distribution)"; content:"|03|x6i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6p.in IMMORTAL (Malware_Distribution)"; content:"|03|x6p|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x7b.in IMMORTAL (Malware_Distribution)"; content:"|03|x7b|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8e.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xb4.in IMMORTAL (Malware_Distribution)"; content:"|03|xb4|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xc6.in IMMORTAL (Malware_Distribution)"; content:"|03|xc6|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xf8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xf8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ai-studio.jp IMMORTAL (Malware_Distribution)"; content:"|09|ai-studio|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americanmedicalproducts.us IMMORTAL (Malware_Distribution)"; content:"|17|americanmedicalproducts|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tacticz.be IMMORTAL (Malware_Distribution)"; content:"|07|tacticz|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup org-tech.net IMMORTAL (Malware_Distribution)"; content:"|08|org-tech|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youramps.ru IMMORTAL (Malware_Distribution)"; content:"|08|youramps|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup add-block-filter.info IMMORTAL (Malware_Distribution)"; content:"|10|add-block-filter|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-x-clips.in IMMORTAL (Malware_Distribution)"; content:"|0c|full-x-clips|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0e.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u19.ru IMMORTAL (Malware_Distribution)"; content:"|03|u19|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9j.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x0v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x1i.ru IMMORTAL (Malware_Distribution)"; content:"|03|x1i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3b.ru IMMORTAL (Malware_Distribution)"; content:"|03|x3b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8y.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9w.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xb4.ru IMMORTAL (Malware_Distribution)"; content:"|03|xb4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xc6.ru IMMORTAL (Malware_Distribution)"; content:"|03|xc6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xc7.ru IMMORTAL (Malware_Distribution)"; content:"|03|xc7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xe6.ru IMMORTAL (Malware_Distribution)"; content:"|03|xe6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xj4.ru IMMORTAL (Malware_Distribution)"; content:"|03|xj4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xk9.ru IMMORTAL (Malware_Distribution)"; content:"|03|xk9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flo4.biz IMMORTAL (Malware_Distribution)"; content:"|04|flo4|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t-online.hu IMMORTAL (Malware_Distribution)"; content:"|08|t-online|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adingurj.com IMMORTAL (Malware_Infectors)"; content:"|08|adingurj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c8t.ru IMMORTAL (Malware_Distribution)"; content:"|03|c8t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f5l.at IMMORTAL (Malware_Distribution)"; content:"|03|f5l|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f5l.ru IMMORTAL (Malware_Distribution)"; content:"|03|f5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f5x.ru IMMORTAL (Malware_Distribution)"; content:"|03|f5x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f6p.at IMMORTAL (Malware_Distribution)"; content:"|03|f6p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3b.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5n.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0b.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1m.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1x.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1y.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3h.ru IMMORTAL (Malware_Distribution)"; content:"|03|u3h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5e.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5k.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6v.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7f.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8i.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8j.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8r.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8t.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8v.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9c.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0c.ru IMMORTAL (Malware_Distribution)"; content:"|03|x0c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3a.ru IMMORTAL (Malware_Distribution)"; content:"|03|x3a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x3v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3y.ru IMMORTAL (Malware_Distribution)"; content:"|03|x3y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6r.ru IMMORTAL (Malware_Distribution)"; content:"|03|x6r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9e.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9f.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9g.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9m.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9n.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9u.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xg8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xg8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yiiw.in IMMORTAL (Malware_Distribution)"; content:"|04|yiiw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6d.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bombino777.com IMMORTAL (Malware_Distribution)"; content:"|0a|bombino777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wvg7.cn IMMORTAL (Malware_Infectors)"; content:"|04|wvg7|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads-block-13.info IMMORTAL (Malware_Infectors)"; content:"|0c|ads-block-13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counter13.info IMMORTAL (Malware_Infectors)"; content:"|09|counter13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icqtel.ru IMMORTAL (Malware_Infectors)"; content:"|06|icqtel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nokiaicq.ru IMMORTAL (Malware_Infectors)"; content:"|08|nokiaicq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qiiiq.ru IMMORTAL (Malware_Infectors)"; content:"|05|qiiiq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t-age.ru IMMORTAL (Malware_Infectors)"; content:"|05|t-age|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 18xn.com IMMORTAL (Malware_Distribution)"; content:"|04|18xn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 30th-birthday.com IMMORTAL (Malware_Distribution)"; content:"|0d|30th-birthday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39j.ru IMMORTAL (Malware_Distribution)"; content:"|03|39j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3c9.ru IMMORTAL (Malware_Distribution)"; content:"|03|3c9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3cl.ru IMMORTAL (Malware_Distribution)"; content:"|03|3cl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-n-d-the.com IMMORTAL (Malware_Distribution)"; content:"|09|a-n-d-the|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3q.ru IMMORTAL (Malware_Distribution)"; content:"|03|a3q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3t.ru IMMORTAL (Malware_Distribution)"; content:"|03|a3t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activeprotect.cn IMMORTAL (Malware_Distribution)"; content:"|0d|activeprotect|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ancom1.ru IMMORTAL (Malware_Distribution)"; content:"|06|ancom1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup automobileandtransport.com IMMORTAL (Malware_Distribution)"; content:"|16|automobileandtransport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b1a.ru IMMORTAL (Malware_Distribution)"; content:"|03|b1a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5c.ru IMMORTAL (Malware_Distribution)"; content:"|03|b5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5z.ru IMMORTAL (Malware_Distribution)"; content:"|03|b5z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6l.ru IMMORTAL (Malware_Distribution)"; content:"|03|b6l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6t.ru IMMORTAL (Malware_Distribution)"; content:"|03|b6t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b8e.ru IMMORTAL (Malware_Distribution)"; content:"|03|b8e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfilmlife.cn IMMORTAL (Malware_Distribution)"; content:"|0c|bestfilmlife|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestlitevideo.cn IMMORTAL (Malware_Distribution)"; content:"|0d|bestlitevideo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopstats.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bigtopstats|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billingcxn.com IMMORTAL (Malware_Distribution)"; content:"|0a|billingcxn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brandnameshoppin.cn IMMORTAL (Malware_Distribution)"; content:"|10|brandnameshoppin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brenz.pl IMMORTAL (Malware_Distribution)"; content:"|05|brenz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c1z.ru IMMORTAL (Malware_Distribution)"; content:"|03|c1z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ce5.ru IMMORTAL (Malware_Distribution)"; content:"|03|ce5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckt4.cn IMMORTAL (Malware_Infectors)"; content:"|04|ckt4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolnamemart.cn IMMORTAL (Malware_Distribution)"; content:"|0c|coolnamemart|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutalot.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|07|cutalot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deryam.biz IMMORTAL (Malware_Distribution)"; content:"|06|deryam|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dreamheartsnow.cn IMMORTAL (Malware_Distribution)"; content:"|0e|dreamheartsnow|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eachbul.com IMMORTAL (Malware_Distribution)"; content:"|07|eachbul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup echarts.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|07|echarts|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electronicssense-search.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|17|electronicssense-search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshsummer.ru IMMORTAL (Malware_Distribution)"; content:"|0b|freshsummer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gclubdiary.com IMMORTAL (Malware_Distribution)"; content:"|0a|gclubdiary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gzpf.in IMMORTAL (Malware_Distribution)"; content:"|04|gzpf|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugebestbuy.cn IMMORTAL (Malware_Distribution)"; content:"|0b|hugebestbuy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iark.net IMMORTAL (Malware_Distribution)"; content:"|04|iark|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkk.tw IMMORTAL (Malware_Distribution)"; content:"|03|jkk|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jumbobestrate.cn IMMORTAL (Malware_Distribution)"; content:"|0d|jumbobestrate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khetiharagro.com IMMORTAL (Malware_Distribution)"; content:"|0c|khetiharagro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koreaexport.co.kr IMMORTAL (Malware_Distribution)"; content:"|0b|koreaexport|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzwn.in IMMORTAL (Malware_Distribution)"; content:"|04|lzwn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsotf.cn IMMORTAL (Malware_Infectors)"; content:"|09|microsotf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mixgrouptravel.cn IMMORTAL (Malware_Distribution)"; content:"|0e|mixgrouptravel|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nettry.tk IMMORTAL (Malware_Distribution)"; content:"|06|nettry|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online358.net IMMORTAL (Malware_Distribution)"; content:"|09|online358|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partychimp.com IMMORTAL (Malware_Distribution)"; content:"|0a|partychimp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prodin.com.ar IMMORTAL (Malware_Distribution)"; content:"|06|prodin|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0c.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0i.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0k.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0l.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0u.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0x.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1b.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1d.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1w.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3s.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3s|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rajresidencydelhi.com IMMORTAL (Malware_Distribution)"; content:"|11|rajresidencydelhi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seamscreative.info IMMORTAL (Malware_Distribution)"; content:"|0d|seamscreative|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secretsalesaffiliate.net IMMORTAL (Malware_Distribution)"; content:"|14|secretsalesaffiliate|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopfilmworld.cn IMMORTAL (Malware_Distribution)"; content:"|0d|shopfilmworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoponlinefilmsite.cn IMMORTAL (Malware_Distribution)"; content:"|12|shoponlinefilmsite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoppicturelife.cn IMMORTAL (Malware_Distribution)"; content:"|0f|shoppicturelife|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soul-suply.ru IMMORTAL (Malware_Distribution)"; content:"|0a|soul-suply|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywareshop.info IMMORTAL (Malware_Infectors)"; content:"|0b|spywareshop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermixlotonline.cn IMMORTAL (Malware_Distribution)"; content:"|11|supermixlotonline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thaistarlight.com IMMORTAL (Malware_Distribution)"; content:"|0d|thaistarlight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turbonamestore.cn IMMORTAL (Malware_Distribution)"; content:"|0e|turbonamestore|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0c.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1b.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5c.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7p.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatedate.cn IMMORTAL (Malware_Infectors)"; content:"|0a|updatedate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wardher.com IMMORTAL (Malware_Distribution)"; content:"|07|wardher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wemsg.com IMMORTAL (Malware_Distribution)"; content:"|05|wemsg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xb6.ru IMMORTAL (Malware_Distribution)"; content:"|03|xb6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xc8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xc8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yb-sport-555.cn IMMORTAL (Malware_Distribution)"; content:"|0c|yb-sport-555|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illusionfest.ru IMMORTAL (Malware_Distribution)"; content:"|0c|illusionfest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourlotcar.cn IMMORTAL (Malware_Distribution)"; content:"|0a|yourlotcar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6l.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ltkq.in IMMORTAL (Malware_Distribution)"; content:"|04|ltkq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superkahn.ru IMMORTAL (SEO_Fraud)"; content:"|09|superkahn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39t.ru IMMORTAL (Malware_Distribution)"; content:"|03|39t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39v.ru IMMORTAL (Malware_Distribution)"; content:"|03|39v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3bq.ru IMMORTAL (Malware_Distribution)"; content:"|03|3bq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3ca.ru IMMORTAL (Malware_Distribution)"; content:"|03|3ca|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3cf.ru IMMORTAL (Malware_Distribution)"; content:"|03|3cf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3cq.ru IMMORTAL (Malware_Distribution)"; content:"|03|3cq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3cw.ru IMMORTAL (Malware_Distribution)"; content:"|03|3cw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f6.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f7.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f8.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f9.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6w2.ru IMMORTAL (Malware_Distribution)"; content:"|03|6w2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3j.ru IMMORTAL (Malware_Distribution)"; content:"|03|a3j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5f.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5h.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5i.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5j.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aireuregio.de IMMORTAL (Malware_Distribution)"; content:"|0a|aireuregio|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aj4.ru IMMORTAL (Malware_Distribution)"; content:"|03|aj4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup al3shaq.com IMMORTAL (Malware_Distribution)"; content:"|07|al3shaq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amour-sexo.com IMMORTAL (Malware_Distribution)"; content:"|0a|amour-sexo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anamaithaperng.com IMMORTAL (Malware_Distribution)"; content:"|0e|anamaithaperng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anandayogaa.org IMMORTAL (Malware_Distribution)"; content:"|0b|anandayogaa|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqua-tectum.hu IMMORTAL (Malware_Distribution)"; content:"|0b|aqua-tectum|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asteam.fr IMMORTAL (Malware_Distribution)"; content:"|06|asteam|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ce5.at IMMORTAL (Malware_Distribution)"; content:"|03|ce5|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eguyendu.com IMMORTAL (Malware_Distribution)"; content:"|08|eguyendu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup introgagu.com IMMORTAL (Malware_Distribution)"; content:"|09|introgagu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iranjoc.com IMMORTAL (Malware_Distribution)"; content:"|07|iranjoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jzion.cn IMMORTAL (Malware_Distribution)"; content:"|05|jzion|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifezilla.ru IMMORTAL (SEO_Fraud)"; content:"|09|lifezilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifoo.ru IMMORTAL (SEO_Fraud)"; content:"|05|lifoo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt010.cn IMMORTAL (Malware_Distribution)"; content:"|05|nt010|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oisrup.com IMMORTAL (Malware_Distribution)"; content:"|06|oisrup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parkperson.ru IMMORTAL (SEO_Fraud)"; content:"|0a|parkperson|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualitysuper.ru IMMORTAL (SEO_Fraud)"; content:"|0c|qualitysuper|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terminal-service.net IMMORTAL (Malware_Distribution)"; content:"|10|terminal-service|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testoid.ru IMMORTAL (SEO_Fraud)"; content:"|07|testoid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-previous-life.ru IMMORTAL (SEO_Fraud)"; content:"|11|the-previous-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8l.in IMMORTAL (Malware_Distribution)"; content:"|03|x8l|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8l.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8m.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8n.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8o.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9o.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9p.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xi3.ru IMMORTAL (Malware_Distribution)"; content:"|03|xi3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xt6.in IMMORTAL (Malware_Distribution)"; content:"|03|xt6|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsguangji.cn IMMORTAL (Malware_Distribution)"; content:"|09|jsguangji|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siyou.org.cn IMMORTAL (Malware_Distribution)"; content:"|05|siyou|03|org|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waztuok.cn IMMORTAL (Malware_Distribution)"; content:"|07|waztuok|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bale.ws IMMORTAL (Malware_Distribution)"; content:"|04|bale|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detkasupe.co.cc IMMORTAL (Malware_Distribution)"; content:"|09|detkasupe|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuqidi9.co.cc IMMORTAL (Malware_Distribution)"; content:"|07|fuqidi9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3car.ru IMMORTAL (Malware_Distribution)"; content:"|06|mp3car|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crotopmodels.com IMMORTAL (Malware_Distribution)"; content:"|0c|crotopmodels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booblegum19.co.cc IMMORTAL (Malware_Distribution)"; content:"|0b|booblegum19|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shgeru43hj.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|shgeru43hj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truepants.ru IMMORTAL (Malware_Distribution)"; content:"|09|truepants|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wmvcentral.net IMMORTAL (Malware_Distribution)"; content:"|0a|wmvcentral|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motionvm.com IMMORTAL (Malware_Distribution)"; content:"|08|motionvm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adbnr.ru IMMORTAL (Malware_Distribution)"; content:"|05|adbnr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htmlads.ru IMMORTAL (Malware_Infectors)"; content:"|07|htmlads|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3bh.ru IMMORTAL (Malware_Distribution)"; content:"|03|3bh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daxia123.cn IMMORTAL (Malware_Distribution)"; content:"|08|daxia123|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eplarine.com IMMORTAL (Malware_Distribution)"; content:"|08|eplarine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagehacks.info IMMORTAL (Malware_Distribution)"; content:"|0a|imagehacks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3e0.ru IMMORTAL (Malware_Distribution)"; content:"|03|3e0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3ew.ru IMMORTAL (Malware_Distribution)"; content:"|03|3ew|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f2.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ncccnnnc.cn IMMORTAL (Malware_Distribution)"; content:"|08|ncccnnnc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup age-free.ru IMMORTAL (Malware_Distribution)"; content:"|08|age-free|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqobeyv.cn IMMORTAL (Malware_Distribution)"; content:"|07|aqobeyv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biozavr.ru IMMORTAL (Malware_Distribution)"; content:"|07|biozavr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biozov.ru IMMORTAL (Malware_Distribution)"; content:"|06|biozov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cybipmo.cn IMMORTAL (Malware_Distribution)"; content:"|07|cybipmo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gevyta.cn IMMORTAL (Malware_Distribution)"; content:"|06|gevyta|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oqaezfy.cn IMMORTAL (Malware_Distribution)"; content:"|07|oqaezfy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osujyre.cn IMMORTAL (Malware_Distribution)"; content:"|07|osujyre|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susnoj.cn IMMORTAL (Malware_Distribution)"; content:"|06|susnoj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweetfay.cn IMMORTAL (Malware_Distribution)"; content:"|08|sweetfay|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upiumry.cn IMMORTAL (Malware_Distribution)"; content:"|07|upiumry|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uzehayb.cn IMMORTAL (Malware_Distribution)"; content:"|07|uzehayb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ynyxeg.cn IMMORTAL (Malware_Distribution)"; content:"|06|ynyxeg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 33duraka.info IMMORTAL (Malware_Infectors)"; content:"|08|33duraka|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5m.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adtcp.ru IMMORTAL (Malware_Distribution)"; content:"|05|adtcp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alienradar.ru IMMORTAL (Malware_Distribution)"; content:"|0a|alienradar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amusecity.com IMMORTAL (Malware_Distribution)"; content:"|09|amusecity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup angelsinuniform.com IMMORTAL (Malware_Distribution)"; content:"|0f|angelsinuniform|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bannerdriven.ru IMMORTAL (Malware_Distribution)"; content:"|0c|bannerdriven|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bannert.ru IMMORTAL (Malware_Distribution)"; content:"|07|bannert|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizbrobiz.cn IMMORTAL (Malware_Infectors)"; content:"|09|bizbrobiz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup black-engine.cn IMMORTAL (Malware_Infectors)"; content:"|0c|black-engine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counterweb.cn IMMORTAL (Malware_Infectors)"; content:"|0a|counterweb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gobcounter.org IMMORTAL (Malware_Distribution)"; content:"|0a|gobcounter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlle.in IMMORTAL (Malware_Distribution)"; content:"|07|googlle|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgnode.cn IMMORTAL (Malware_Infectors)"; content:"|07|imgnode|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-counter.info IMMORTAL (Malware_Infectors)"; content:"|0c|live-counter|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mefa.ws IMMORTAL (Malware_Infectors)"; content:"|04|mefa|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobydickrock.ru IMMORTAL (Malware_Distribution)"; content:"|0c|mobydickrock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nailxpert.com IMMORTAL (Phishing_and_Theft)"; content:"|09|nailxpert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsoff.net IMMORTAL (Malware_Infectors)"; content:"|07|newsoff|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pietka.eu IMMORTAL (Malware_Distribution)"; content:"|06|pietka|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proanalytics.cn IMMORTAL (Malware_Infectors)"; content:"|0c|proanalytics|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ravelotti.cn IMMORTAL (Malware_Infectors)"; content:"|09|ravelotti|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup style-boards.com IMMORTAL (Malware_Infectors)"; content:"|0c|style-boards|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sutadut.co.cc IMMORTAL (Malware_Infectors)"; content:"|07|sutadut|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testodrome.ru IMMORTAL (Malware_Infectors)"; content:"|0a|testodrome|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thestatsgov.info IMMORTAL (Spyware)"; content:"|0b|thestatsgov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vseseriozno.cn IMMORTAL (Malware_Infectors)"; content:"|0b|vseseriozno|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldrat.ru IMMORTAL (Malware_Infectors)"; content:"|08|worldrat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yondental.co.kr IMMORTAL (Malware_Distribution)"; content:"|09|yondental|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt002.cn IMMORTAL (Malware_Distribution)"; content:"|05|nt002|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yournamequickshop.cn IMMORTAL (Spyware)"; content:"|11|yournamequickshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9speed.info IMMORTAL (Malware_Distribution)"; content:"|06|9speed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9spice.info IMMORTAL (Malware_Distribution)"; content:"|06|9spice|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup add-block-11.info IMMORTAL (Malware_Infectors)"; content:"|0c|add-block-11|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anzantra.se IMMORTAL (Malware_Distribution)"; content:"|08|anzantra|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b8o.ru IMMORTAL (Malware_Distribution)"; content:"|03|b8o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b9g.ru IMMORTAL (Malware_Distribution)"; content:"|03|b9g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beofree.ru IMMORTAL (Malware_Distribution)"; content:"|07|beofree|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brandschutztechnik-hartmann.de IMMORTAL (Malware_Distribution)"; content:"|1b|brandschutztechnik-hartmann|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deth-test.ru IMMORTAL (Malware_Infectors)"; content:"|09|deth-test|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feelife.ru IMMORTAL (Malware_Distribution)"; content:"|07|feelife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostads.cn IMMORTAL (Malware_Distribution)"; content:"|07|hostads|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m77s.cn IMMORTAL (Malware_Infectors)"; content:"|04|m77s|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbakoff.com IMMORTAL (Malware_Infectors)"; content:"|07|nbakoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neimeetsmysla.cn IMMORTAL (Malware_Distribution)"; content:"|0d|neimeetsmysla|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup past-another-life.ru IMMORTAL (Malware_Infectors)"; content:"|11|past-another-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supernil.ru IMMORTAL (Malware_Infectors)"; content:"|08|supernil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yessvaz.cn IMMORTAL (Malware_Distribution)"; content:"|07|yessvaz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5j.at IMMORTAL (Malware_Distribution)"; content:"|03|a5j|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5m.at IMMORTAL (Malware_Distribution)"; content:"|03|a5m|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5r.at IMMORTAL (Malware_Distribution)"; content:"|03|b5r|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6l.at IMMORTAL (Malware_Distribution)"; content:"|03|b6l|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6t.at IMMORTAL (Malware_Distribution)"; content:"|03|b6t|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b7g.at IMMORTAL (Malware_Distribution)"; content:"|03|b7g|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b7p.at IMMORTAL (Malware_Distribution)"; content:"|03|b7p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beachhousename.cn IMMORTAL (Malware_Distribution)"; content:"|0e|beachhousename|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopleads.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bigtopleads|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtoprocks.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bigtoprocks|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bqtl.in IMMORTAL (Malware_Distribution)"; content:"|04|bqtl|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c6h.at IMMORTAL (Malware_Distribution)"; content:"|03|c6h|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c8t.at IMMORTAL (Malware_Distribution)"; content:"|03|c8t|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c9u.at IMMORTAL (Malware_Distribution)"; content:"|03|c9u|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynamicfilmmedia.cn IMMORTAL (Malware_Distribution)"; content:"|10|dynamicfilmmedia|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f7p.at IMMORTAL (Malware_Distribution)"; content:"|03|f7p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f7y.at IMMORTAL (Malware_Distribution)"; content:"|03|f7y|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kkxv.in IMMORTAL (Malware_Distribution)"; content:"|04|kkxv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup martpictureexistence.cn IMMORTAL (Malware_Distribution)"; content:"|14|martpictureexistence|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meldorgroup.cn IMMORTAL (Malware_Distribution)"; content:"|0b|meldorgroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nqrl.in IMMORTAL (Malware_Distribution)"; content:"|04|nqrl|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oufc.in IMMORTAL (Malware_Distribution)"; content:"|04|oufc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0w.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1l.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3c.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5k.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0r.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1j.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3j.ru IMMORTAL (Malware_Distribution)"; content:"|03|u3j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3m.ru IMMORTAL (Malware_Distribution)"; content:"|03|u3m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3y.ru IMMORTAL (Malware_Distribution)"; content:"|03|u3y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5m.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5v.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6n.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7e.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7n.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7x.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8b.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8h.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9b.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9k.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b4.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c8b.ru IMMORTAL (Malware_Distribution)"; content:"|03|c8b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39u.ru IMMORTAL (Malware_Distribution)"; content:"|03|39u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39w.ru IMMORTAL (Malware_Distribution)"; content:"|03|39w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3a1.ru IMMORTAL (Malware_Distribution)"; content:"|03|3a1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3a2.ru IMMORTAL (Malware_Distribution)"; content:"|03|3a2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b6.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b7.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b8.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b9.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3bp.ru IMMORTAL (Malware_Distribution)"; content:"|03|3bp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c8k.ru IMMORTAL (Malware_Distribution)"; content:"|03|c8k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1v.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3n.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3o.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6x.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8w.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xb8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xb8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xd4.ru IMMORTAL (Malware_Distribution)"; content:"|03|xd4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xf0.ru IMMORTAL (Malware_Distribution)"; content:"|03|xf0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xf9.ru IMMORTAL (Malware_Distribution)"; content:"|03|xf9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xg0.ru IMMORTAL (Malware_Distribution)"; content:"|03|xg0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xh4.ru IMMORTAL (Malware_Distribution)"; content:"|03|xh4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xq0.ru IMMORTAL (Malware_Distribution)"; content:"|03|xq0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xq9.ru IMMORTAL (Malware_Distribution)"; content:"|03|xq9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xv9.ru IMMORTAL (Malware_Distribution)"; content:"|03|xv9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in-t-h-e.cn IMMORTAL (Malware_Distribution)"; content:"|08|in-t-h-e|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vht0.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|vht0|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f6y.ru IMMORTAL (Malware_Distribution)"; content:"|03|f6y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f7y.ru IMMORTAL (Malware_Distribution)"; content:"|03|f7y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lizamoon.com IMMORTAL (Malware_Distribution)"; content:"|08|lizamoon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eriflsaovdvdsa.co.cc IMMORTAL (Malware_Distribution)"; content:"|0e|eriflsaovdvdsa|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deonixion.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|09|deonixion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwcfg.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|06|wwwcfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xepace.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|06|xepace|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemacro.com IMMORTAL (Malware_Distribution)"; content:"|0b|onlinemacro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup natursteindichtstoff.de IMMORTAL (Malware_Distribution)"; content:"|14|natursteindichtstoff|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 31ad.com IMMORTAL (Malware_Distribution)"; content:"|04|31ad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iberostaronline.com IMMORTAL (Malware_Distribution)"; content:"|0f|iberostaronline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yandex-in.ru IMMORTAL (Malware_Distribution)"; content:"|09|yandex-in|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trobermain.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|trobermain|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uh.pl IMMORTAL (Malware_Distribution)"; content:"|02|uh|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freexxpote.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|freexxpote|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barbosogranul.ru IMMORTAL (Malware_Distribution)"; content:"|0d|barbosogranul|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cache-3942.net IMMORTAL (Malware_Distribution)"; content:"|0a|cache-3942|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goptres.co.cc IMMORTAL (Malware_Distribution)"; content:"|07|goptres|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pushot.com IMMORTAL (Malware_Distribution)"; content:"|06|pushot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7417788.ru IMMORTAL (Malware_Distribution)"; content:"|07|7417788|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-z-uebersetzer.at IMMORTAL (Malware_Distribution)"; content:"|0f|a-z-uebersetzer|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aashaclinic.com IMMORTAL (Malware_Distribution)"; content:"|0b|aashaclinic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adware2010.com IMMORTAL (Malware_Infectors)"; content:"|0a|adware2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop-hosting-bisingen.de IMMORTAL (Malware_Distribution)"; content:"|15|shop-hosting-bisingen|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ati21.co.kr IMMORTAL (Malware_Distribution)"; content:"|05|ati21|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup castleestateslondon.co.uk IMMORTAL (Malware_Distribution)"; content:"|13|castleestateslondon|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livestro.nl IMMORTAL (Malware_Distribution)"; content:"|08|livestro|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interactive.info.pl IMMORTAL (Malware_Distribution)"; content:"|0b|interactive|04|info|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kantum.net IMMORTAL (Malware_Distribution)"; content:"|06|kantum|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relaax.co.cc IMMORTAL (Malware_Distribution)"; content:"|06|relaax|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylemoncity.com IMMORTAL (Malware_Distribution)"; content:"|0b|mylemoncity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paqtool.com IMMORTAL (Malware_Distribution)"; content:"|07|paqtool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-med-shop.com IMMORTAL (Malware_Distribution)"; content:"|0d|best-med-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forgottencelebs.com IMMORTAL (Malware_Distribution)"; content:"|0f|forgottencelebs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nabijarka.pl IMMORTAL (Malware_Distribution)"; content:"|09|nabijarka|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odmarco.com IMMORTAL (Malware_Distribution)"; content:"|07|odmarco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trughtsa.com IMMORTAL (Malware_Distribution)"; content:"|08|trughtsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waipdns.ru IMMORTAL (Malware_Distribution)"; content:"|07|waipdns|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup womenzz.com IMMORTAL (Malware_Infectors)"; content:"|07|womenzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsnjineh87.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|0a|gsnjineh87|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alwasluae.net IMMORTAL (Malware_Distribution)"; content:"|09|alwasluae|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tds-23vb8g5ff.co.cc IMMORTAL (Malware_Distribution)"; content:"|0d|tds-23vb8g5ff|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rouyangw.com (Malware_Distribution)"; content:"|08|rouyangw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 001e2e4.info (Malware_Distribution)"; content:"|07|001e2e4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2work-at-home.ws (Malware_Distribution)"; content:"|0d|2work-at-home|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6r66.com (Malware_Distribution)"; content:"|04|6r66|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adefarichz.co.cc ()"; content:"|0a|adefarichz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ankarahavalari.net (Malware_Distribution)"; content:"|0e|ankarahavalari|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apsagsoumyp42o.co.cc ()"; content:"|0e|apsagsoumyp42o|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arenelx1l.co.cc ()"; content:"|09|arenelx1l|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artoflivingfaridabad.org (Malware_Distribution)"; content:"|14|artoflivingfaridabad|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buitalanbu6.co.cc ()"; content:"|0b|buitalanbu6|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulldogfit.com (Malware_Distribution)"; content:"|0a|bulldogfit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bustmiswoodckosnh.co.cc ()"; content:"|11|bustmiswoodckosnh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buzzpozapyq5.co.cc ()"; content:"|0c|buzzpozapyq5|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catbepow372.co.cc ()"; content:"|0b|catbepow372|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chilibeans.co.uk (Malware_Distribution)"; content:"|0a|chilibeans|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cklik.in ()"; content:"|05|cklik|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup co-nf-iguer-vo-tr-e-comp-tte.com (Malware_Distribution)"; content:"|1c|co-nf-iguer-vo-tr-e-comp-tte|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup congrinaleo.co.cc ()"; content:"|0b|congrinaleo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crowpaetucep95m.co.cc ()"; content:"|0f|crowpaetucep95m|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuttcanthnaznu.co.cc ()"; content:"|0e|cuttcanthnaznu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deathstippark1h.co.cc ()"; content:"|0f|deathstippark1h|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decapivetr.co.cc ()"; content:"|0a|decapivetr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dendthylthejnu.co.cc ()"; content:"|0e|dendthylthejnu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhish.info (Malware_Distribution)"; content:"|05|dhish|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ehost-services138.com (Malware_Distribution)"; content:"|11|ehost-services138|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ensortlem.com (Malware_Infectors)"; content:"|09|ensortlem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanbaperpeisg.co.cc ()"; content:"|0d|fanbaperpeisg|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filtsubscalsuvrl.co.cc ()"; content:"|10|filtsubscalsuvrl|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finepc-keeper.net (Fake_AV)"; content:"|0d|finepc-keeper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finepckeeper.com (Fake_AV)"; content:"|0c|finepckeeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestuffholder.net (Fake_AV)"; content:"|0f|finestuffholder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fledunoutin5t.co.cc ()"; content:"|0d|fledunoutin5t|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gatthanbastams.co.cc ()"; content:"|0e|gatthanbastams|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geoganshi5n5.co.cc ()"; content:"|0c|geoganshi5n5|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gesnecalti7qc.co.cc ()"; content:"|0d|gesnecalti7qc|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenpix.in (Malware_Distribution)"; content:"|08|greenpix|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guarddra.com (Fake_AV)"; content:"|08|guarddra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guarddricongpc.net (Fake_AV)"; content:"|0e|guarddricongpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedady.com (Fake_AV)"; content:"|0a|guardedady|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedahot.com (Fake_AV)"; content:"|0b|guardedahot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedall.com (Fake_AV)"; content:"|0a|guardedall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedblou.com (Fake_AV)"; content:"|0b|guardedblou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedbus.com (Fake_AV)"; content:"|0a|guardedbus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedciss.com (Fake_AV)"; content:"|0b|guardedciss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedcome.com (Fake_AV)"; content:"|0b|guardedcome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedeum.com (Fake_AV)"; content:"|0a|guardedeum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwall-si.com (Fake_AV)"; content:"|0c|guardwall-si|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwall-ta.com (Fake_AV)"; content:"|0c|guardwall-ta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwall-ti.com (Fake_AV)"; content:"|0c|guardwall-ti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwall-to.com (Fake_AV)"; content:"|0c|guardwall-to|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwall-ws.com (Fake_AV)"; content:"|0c|guardwall-ws|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwallsi.com (Fake_AV)"; content:"|0b|guardwallsi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwallta.com (Fake_AV)"; content:"|0b|guardwallta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwallti.com (Fake_AV)"; content:"|0b|guardwallti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwallto.com (Fake_AV)"; content:"|0b|guardwallto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwallws.com (Fake_AV)"; content:"|0b|guardwallws|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hadetector.com (Fake_AV)"; content:"|0a|hadetector|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-antivir-master.com (Fake_AV)"; content:"|13|hard-antivir-master|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-cleanforyou.com (Fake_AV)"; content:"|10|hard-cleanforyou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-guardinchecker.net (Fake_AV)"; content:"|13|hard-guardinchecker|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-internet-4u.com (Fake_AV)"; content:"|10|hard-internet-4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-internet-soft.com (Fake_AV)"; content:"|12|hard-internet-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardantivirchecker.com (Fake_AV)"; content:"|12|hardantivirchecker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardnetworkholder.net (Fake_AV)"; content:"|11|hardnetworkholder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardscandefense.net (Fake_AV)"; content:"|0f|hardscandefense|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardscanmaster.net (Fake_AV)"; content:"|0e|hardscanmaster|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardsecuritydefense.net (Fake_AV)"; content:"|13|hardsecuritydefense|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hedetector.net (Fake_AV)"; content:"|0a|hedetector|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helpav-soft.com (Fake_AV)"; content:"|0b|helpav-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoerhinbendescrt.co.cc ()"; content:"|10|hoerhinbendescrt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibsummabobs1q.co.cc ()"; content:"|0d|ibsummabobs1q|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ictiforkh.co.cc ()"; content:"|09|ictiforkh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup injoyprotection-softscan.com (Fake_AV)"; content:"|18|injoyprotection-softscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insoftprotect.com (Fake_AV)"; content:"|0d|insoftprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetissafe.com (Fake_AV)"; content:"|0e|internetissafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetsecurity-suite.com (Fake_AV)"; content:"|16|internetsecurity-suite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetsmart-secure4u.net (Fake_AV)"; content:"|16|internetsmart-secure4u|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup invisibleprotection.net (Fake_AV)"; content:"|13|invisibleprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqtzbgiqva1496fk.com (Fake_AV)"; content:"|10|iqtzbgiqva1496fk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isdignsafe.com (Fake_AV)"; content:"|0a|isdignsafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacbocome6.co.cc ()"; content:"|0a|jacbocome6|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjoxffjlprx1440b.com (Fake_AV)"; content:"|10|jjoxffjlprx1440b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jlpvxxyhpxa1472.com (Fake_AV)"; content:"|0f|jlpvxxyhpxa1472|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup just-free-soft10.com (Fake_AV)"; content:"|10|just-free-soft10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup just-free-soft11.net (Fake_AV)"; content:"|10|just-free-soft11|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup just-free-soft12.com (Fake_AV)"; content:"|10|just-free-soft12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup just-free-soft13.net (Fake_AV)"; content:"|10|just-free-soft13|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justscansoft32.com (Fake_AV)"; content:"|0e|justscansoft32|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justscansoft33.net (Fake_AV)"; content:"|0e|justscansoft33|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justscansoft34.com (Fake_AV)"; content:"|0e|justscansoft34|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kannmowarmq2.co.cc ()"; content:"|0c|kannmowarmq2|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keep-avsoftdifence.com (Fake_AV)"; content:"|12|keep-avsoftdifence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keeper-shelter-av.net (Fake_AV)"; content:"|11|keeper-shelter-av|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-drivechecker.net (Fake_AV)"; content:"|11|last-drivechecker|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-driveholder.com (Fake_AV)"; content:"|10|last-driveholder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-driveholder.net (Fake_AV)"; content:"|10|last-driveholder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-drivekeeper.net (Fake_AV)"; content:"|10|last-drivekeeper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-drivemaster.com (Fake_AV)"; content:"|10|last-drivemaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-filekeeper.com (Fake_AV)"; content:"|0f|last-filekeeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-pc-keeper.com (Fake_AV)"; content:"|0e|last-pc-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-pcguard.net (Fake_AV)"; content:"|0c|last-pcguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-pcmaster.net (Fake_AV)"; content:"|0d|last-pcmaster|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-stuff-holder.com (Fake_AV)"; content:"|11|last-stuff-holder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-stuff-keeper.com (Fake_AV)"; content:"|11|last-stuff-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-stuff-master.net (Fake_AV)"; content:"|11|last-stuff-master|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-stuffkeeper.com (Fake_AV)"; content:"|10|last-stuffkeeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-your-holder.net (Fake_AV)"; content:"|10|last-your-holder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last-your-master.net (Fake_AV)"; content:"|10|last-your-master|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastdrive-checker.net (Fake_AV)"; content:"|11|lastdrive-checker|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastdrive-master.com (Fake_AV)"; content:"|10|lastdrive-master|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastdriveguard.net (Fake_AV)"; content:"|0e|lastdriveguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastyour-guard.net (Fake_AV)"; content:"|0e|lastyour-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastyour-holder.net (Fake_AV)"; content:"|0f|lastyour-holder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastyour-master.net (Fake_AV)"; content:"|0f|lastyour-master|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastyourkeeper.net (Fake_AV)"; content:"|0e|lastyourkeeper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup link-gen-security11.com (Fake_AV)"; content:"|13|link-gen-security11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup link-gen-security12.com (Fake_AV)"; content:"|13|link-gen-security12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup link-gen-security13.com (Fake_AV)"; content:"|13|link-gen-security13|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup link-gen-security14.com (Fake_AV)"; content:"|13|link-gen-security14|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup link-gen-security15.com (Fake_AV)"; content:"|13|link-gen-security15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup link-gen-security16.com (Fake_AV)"; content:"|13|link-gen-security16|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litescanforsoft.net (Fake_AV)"; content:"|0f|litescanforsoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loismolaqimvab.co.cc ()"; content:"|0e|loismolaqimvab|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lrecamac8r4.co.cc ()"; content:"|0b|lrecamac8r4|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macrogaurd21.com (Fake_AV)"; content:"|0c|macrogaurd21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macrogaurd22.net (Fake_AV)"; content:"|0c|macrogaurd22|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macrogaurd23.com (Fake_AV)"; content:"|0c|macrogaurd23|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macrogaurd24.net (Fake_AV)"; content:"|0c|macrogaurd24|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macrogaurd25.com (Fake_AV)"; content:"|0c|macrogaurd25|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macrogaurd26.net (Fake_AV)"; content:"|0c|macrogaurd26|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macrogaurd27.com (Fake_AV)"; content:"|0c|macrogaurd27|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macronessi9.co.cc ()"; content:"|0b|macronessi9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magicalyatra.com (Malware_Distribution)"; content:"|0c|magicalyatra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metersaddrantb7.co.cc ()"; content:"|0f|metersaddrantb7|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mokaped.com (Malware_Distribution)"; content:"|07|mokaped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup montlimal.co.cc ()"; content:"|09|montlimal|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbag.org.in (Malware_Distribution)"; content:"|04|nbag|03|org|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nutnorbntegiw0.co.cc ()"; content:"|0e|nutnorbntegiw0|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opupreggazti.co.cc ()"; content:"|0c|opupreggazti|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parlandcolrac1u.co.cc ()"; content:"|0f|parlandcolrac1u|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pekiguaningmv.co.cc ()"; content:"|0d|pekiguaningmv|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pensvernohp.co.cc ()"; content:"|0b|pensvernohp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phoderadc9i.co.cc ()"; content:"|0b|phoderadc9i|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plandicardyu9.co.cc ()"; content:"|0d|plandicardyu9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pordisfpoc64.co.cc ()"; content:"|0c|pordisfpoc64|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profifreturqn.co.cc ()"; content:"|0d|profifreturqn|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup questeprap28.co.cc ()"; content:"|0c|questeprap28|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rapaconptf.co.cc ()"; content:"|0a|rapaconptf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riapaewarmcooksbm.co.cc ()"; content:"|11|riapaewarmcooksbm|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rohislantsello.co.cc ()"; content:"|0e|rohislantsello|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sadrfedwer.co.cc ()"; content:"|0a|sadrfedwer|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saduhydsp.co.cc ()"; content:"|09|saduhydsp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saiclevaps1s.co.cc ()"; content:"|0c|saiclevaps1s|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sandsatdar3.co.cc ()"; content:"|0b|sandsatdar3|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantv.com (Malware_Distribution)"; content:"|0b|scannerantv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerblueantivxp.com (Malware_Distribution)"; content:"|12|scannerblueantivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerqueenantivxp.com (Malware_Distribution)"; content:"|13|scannerqueenantivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanwinagainstvirus.com (Fake_AV)"; content:"|13|scanwinagainstvirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanwinantivirsen.com (Fake_AV)"; content:"|11|scanwinantivirsen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanwinantivirus.com (Fake_AV)"; content:"|10|scanwinantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanwinantivirxp.com (Fake_AV)"; content:"|10|scanwinantivirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanwinwarvirxp.com (Malware_Distribution)"; content:"|0f|scanwinwarvirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scesniasay3u.co.cc ()"; content:"|0c|scesniasay3u|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sedpoo.com (Malware_Distribution)"; content:"|06|sedpoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup semiticvirusxpsoft.com (Fake_AV)"; content:"|12|semiticvirusxpsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setibetkeee8r.co.cc ()"; content:"|0d|setibetkeee8r|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shinsegae.com (Malware_Distribution)"; content:"|09|shinsegae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siidosantv.co.cc ()"; content:"|0a|siidosantv|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smollpassy.com (Malware_Distribution)"; content:"|0a|smollpassy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sqeestheogwenrepm83.co.cc ()"; content:"|13|sqeestheogwenrepm83|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-power-defense7.net (Fake_AV)"; content:"|15|strong-power-defense7|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-power-defense8.net (Fake_AV)"; content:"|15|strong-power-defense8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-power-scanner.net (Fake_AV)"; content:"|14|strong-power-scanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-scansoft.net (Fake_AV)"; content:"|0f|strong-scansoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syswareinfotech.com (Malware_Distribution)"; content:"|0f|syswareinfotech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taeliterup.ru (Spyware)"; content:"|0a|taeliterup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup talcoutip2y.co.cc ()"; content:"|0b|talcoutip2y|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teoucbosonenfo.co.cc ()"; content:"|0e|teoucbosonenfo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantivirusscano.com (Fake_AV)"; content:"|11|theantivirusscano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantivirusscanoxp.com (Fake_AV)"; content:"|13|theantivirusscanoxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestsecurity-holder.com (Fake_AV)"; content:"|16|thebestsecurity-holder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestsecurity-scanner.com (Fake_AV)"; content:"|17|thebestsecurity-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestsuite-foryou.com (Fake_AV)"; content:"|13|thebestsuite-foryou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theprotectionxp.com (Malware_Distribution)"; content:"|0f|theprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thewinantivirusnow.com (Fake_AV)"; content:"|12|thewinantivirusnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thewinantivirusxp.com (Fake_AV)"; content:"|11|thewinantivirusxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thewinsantivirus.com (Fake_AV)"; content:"|10|thewinsantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tingrobfoz60.co.cc ()"; content:"|0c|tingrobfoz60|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tionforhardversry.co.cc ()"; content:"|11|tionforhardversry|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tool-powerandsheild.com (Fake_AV)"; content:"|13|tool-powerandsheild|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tools-bestfor-secure.net (Fake_AV)"; content:"|14|tools-bestfor-secure|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tools-for-your-security.net (Fake_AV)"; content:"|17|tools-for-your-security|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-antivir-defense.net (Fake_AV)"; content:"|13|top-antivir-defense|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-clean-foryou.net (Fake_AV)"; content:"|10|top-clean-foryou|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-file-keeper.com (Fake_AV)"; content:"|0f|top-file-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tournamentantivirusxp.com (Fake_AV)"; content:"|15|tournamentantivirusxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tournamentwinantivirus.com (Fake_AV)"; content:"|16|tournamentwinantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tournamentwinantivirus.net (Fake_AV)"; content:"|16|tournamentwinantivirus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tovamcspirsux.uni.cc (Malware_Distribution)"; content:"|0d|tovamcspirsux|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vacuumguide.co.cc ()"; content:"|0b|vacuumguide|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vacuumreview.co.cc ()"; content:"|0c|vacuumreview|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vesporno.com ()"; content:"|08|vesporno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgob.info (Malware_Distribution)"; content:"|04|vgob|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warvirusscanoxp.com (Fake_AV)"; content:"|0f|warvirusscanoxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webantivirusscanoxp.com (Fake_AV)"; content:"|13|webantivirusscanoxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webnovidades.kilu.net (Malware_Distribution)"; content:"|0c|webnovidades|04|kilu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webprotectionxpwin.com (Malware_Distribution)"; content:"|12|webprotectionxpwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webscanwinantivirus.com (Fake_AV)"; content:"|13|webscanwinantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webwinantivirusnow.com (Fake_AV)"; content:"|12|webwinantivirusnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webwinsantivirusxp.com (Fake_AV)"; content:"|12|webwinsantivirusxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winagainstvirusxp.com (Fake_AV)"; content:"|11|winagainstvirusxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winantiagencynow.com (Malware_Distribution)"; content:"|10|winantiagencynow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winantivirustournament.com (Fake_AV)"; content:"|16|winantivirustournament|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wizard2.sbs.co.kr (Malware_Infectors)"; content:"|07|wizard2|03|sbs|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpowgihydreegk.co.cc ()"; content:"|0e|xpowgihydreegk|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnecqapp.co.cc ()"; content:"|09|yhnecqapp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zyxyfy.com (Malware_Infectors)"; content:"|06|zyxyfy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fetiking.kir.jp (Malware_Distribution)"; content:"|08|fetiking|03|kir|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liiff.ru (Malware_Distribution)"; content:"|05|liiff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyptuk.cn (Malware_Distribution)"; content:"|06|lyptuk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makerealcashnow.com (Malware_Distribution)"; content:"|0f|makerealcashnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mirchinews.in (Malware_Distribution)"; content:"|0a|mirchinews|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poragraph.by.ru (Malware_Distribution)"; content:"|09|poragraph|02|by|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proppera.co.cc (Malware_Distribution)"; content:"|08|proppera|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soketuparikh.com (Malware_Distribution)"; content:"|0c|soketuparikh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup szdamuzhi.com (Malware_Distribution)"; content:"|09|szdamuzhi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukuymfi.cn (Malware_Distribution)"; content:"|07|ukuymfi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websitenaples.com (Malware_Distribution)"; content:"|0d|websitenaples|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abena.co.kr (Malware_Distribution)"; content:"|05|abena|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anjans.com (Malware_Distribution)"; content:"|06|anjans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boloz.com (Malware_Distribution)"; content:"|05|boloz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brookegypt.com (Malware_Distribution)"; content:"|0a|brookegypt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brute.ru (Malware_Distribution)"; content:"|05|brute|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camfrog4all.com (Malware_Distribution)"; content:"|0b|camfrog4all|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebhosting.co.kr (Malware_Distribution)"; content:"|09|ebhosting|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findaguesthouse.co.uk (Malware_Distribution)"; content:"|0f|findaguesthouse|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gmarket.co.kr (Malware_Distribution)"; content:"|07|gmarket|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipma.co.in (Malware_Distribution)"; content:"|04|ipma|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mexicohoneymoonhotel.com (Malware_Distribution)"; content:"|14|mexicohoneymoonhotel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt06.in (Spyware)"; content:"|04|nt06|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt07.in (Spyware)"; content:"|04|nt07|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ulka-gallery.yoyo.pl (Malware_Distribution)"; content:"|0c|ulka-gallery|04|yoyo|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zumugolter.com (Malware_Infectors)"; content:"|0a|zumugolter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 108hao.com (Malware_Distribution)"; content:"|06|108hao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amcdrrkorea.org (Malware_Distribution)"; content:"|0b|amcdrrkorea|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerexlimited.com (Malware_Distribution)"; content:"|0e|powerexlimited|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukrec2rec.co.uk (Malware_Distribution)"; content:"|09|ukrec2rec|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3roqy-t.com (Malware_Distribution)"; content:"|07|3roqy-t|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hss-klan.yoyo.pl (Malware_Distribution)"; content:"|08|hss-klan|04|yoyo|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8addition.info (Malware_Distribution)"; content:"|09|8addition|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aandedoorns.co.za (Malware_Infectors)"; content:"|0b|aandedoorns|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup againstvirusxpsoft.com (Fake_AV)"; content:"|12|againstvirusxpsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup againstvirysscanxp.com (Spyware)"; content:"|12|againstvirysscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ageofrappelz.com (Malware_Infectors)"; content:"|0c|ageofrappelz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aipco.ru (Malware_Infectors)"; content:"|05|aipco|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-v-free-virusscan.com (Fake_AV)"; content:"|15|anti-v-free-virusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-volt-free-virusscan.com (Fake_AV)"; content:"|18|anti-volt-free-virusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antilimit.bissnes.net (Zeus_Zbot_SpyEye)"; content:"|09|antilimit|07|bissnes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivcastscanner.com (Spyware)"; content:"|10|antivcastscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivcastscanwinxp.com (Spyware)"; content:"|12|antivcastscanwinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivgamesfreevirusscan.com (Fake_AV)"; content:"|17|antivgamesfreevirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armour-antivirus.ce.ms (Fake_AV)"; content:"|10|armour-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avfi.info (Malware_Infectors)"; content:"|04|avfi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b3d.mezon.ru (Malware_Infectors)"; content:"|03|b3d|05|mezon|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bansher.com (Zeus_Zbot_SpyEye)"; content:"|07|bansher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bed.3-a.net (Malware_Infectors)"; content:"|03|bed|03|3-a|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belas61.com.br (Malware_Infectors)"; content:"|07|belas61|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsuite-guard.net (Fake_AV)"; content:"|0f|bestsuite-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsuiteforu.com (Fake_AV)"; content:"|0d|bestsuiteforu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boselfprotection.com (Fake_AV)"; content:"|10|boselfprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cafmedic.com (Malware_Infectors)"; content:"|08|cafmedic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caixinmoto88.com (Malware_Distribution)"; content:"|0c|caixinmoto88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checksofttest.net (Fake_AV)"; content:"|0d|checksofttest|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checksoftxt.com (Fake_AV)"; content:"|0b|checksoftxt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chprofi-soft.com (Fake_AV)"; content:"|0c|chprofi-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chselfprotection.com (Fake_AV)"; content:"|10|chselfprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clavn.ru (Zeus_Zbot_SpyEye)"; content:"|05|clavn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crsoftprotect.com (Fake_AV)"; content:"|0d|crsoftprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxuf.info (Malware_Infectors)"; content:"|04|cxuf|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyprotect-pc.com (Fake_AV)"; content:"|0c|cyprotect-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deepscanandprotecion.com (Fake_AV)"; content:"|14|deepscanandprotecion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deepscanfile.com (Fake_AV)"; content:"|0c|deepscanfile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detectorst.com (Fake_AV)"; content:"|0a|detectorst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup difence-for-me.net (Fake_AV)"; content:"|0e|difence-for-me|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diprotect-pc.com (Fake_AV)"; content:"|0c|diprotect-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diskn.com (Malware_Distribution)"; content:"|05|diskn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dksxe518hmrtvbg.com (Fake_AV)"; content:"|0f|dksxe518hmrtvbg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlrtt646bimpvzf.com (Fake_AV)"; content:"|0f|dlrtt646bimpvzf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drstore1.com (Malware_Infectors)"; content:"|08|drstore1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edunkp2.org (Malware_Distribution)"; content:"|07|edunkp2|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ehdbhaowiejud.co.cc (Malware_Infectors)"; content:"|0d|ehdbhaowiejud|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup executivegov.com (Malware_Infectors)"; content:"|0c|executivegov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extrabensen.org (Spyware)"; content:"|0b|extrabensen|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft40.com (Fake_AV)"; content:"|0e|fastscansoft40|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft41.com (Fake_AV)"; content:"|0e|fastscansoft41|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft42.net (Fake_AV)"; content:"|0e|fastscansoft42|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft43.net (Fake_AV)"; content:"|0e|fastscansoft43|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft44.net (Fake_AV)"; content:"|0e|fastscansoft44|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft45.com (Fake_AV)"; content:"|0e|fastscansoft45|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft46.com (Fake_AV)"; content:"|0e|fastscansoft46|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft47.com (Fake_AV)"; content:"|0e|fastscansoft47|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft48.com (Fake_AV)"; content:"|0e|fastscansoft48|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft49.net (Fake_AV)"; content:"|0e|fastscansoft49|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansoft50.com (Fake_AV)"; content:"|0e|fastscansoft50|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feksake.biz (Malware_Distribution)"; content:"|07|feksake|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-down.co.kr (Malware_Infectors)"; content:"|09|file-down|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileprotection-av.com (Fake_AV)"; content:"|11|fileprotection-av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileprotectiosoft.net (Fake_AV)"; content:"|11|fileprotectiosoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finalavpro.net (Fake_AV)"; content:"|0a|finalavpro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-drive-keeper.com (Fake_AV)"; content:"|11|fine-drive-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-file-holder.net (Fake_AV)"; content:"|10|fine-file-holder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-file-master.com (Fake_AV)"; content:"|10|fine-file-master|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-pc-guard.com (Fake_AV)"; content:"|0d|fine-pc-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-pcchecker.com (Fake_AV)"; content:"|0e|fine-pcchecker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-pcguard.net (Fake_AV)"; content:"|0c|fine-pcguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-pcholder.com (Fake_AV)"; content:"|0d|fine-pcholder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-pckeeper.com (Fake_AV)"; content:"|0d|fine-pckeeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-pcmaster.net (Fake_AV)"; content:"|0d|fine-pcmaster|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-stuff-master.net (Fake_AV)"; content:"|11|fine-stuff-master|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freesoftware.us.to (Malware_Infectors)"; content:"|0c|freesoftware|02|us|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funboxkey.com (Malware_Infectors)"; content:"|09|funboxkey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyxm.net ()"; content:"|04|fyxm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup game-party-royal.ru (Malware_Infectors)"; content:"|10|game-party-royal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gay-gay.it ()"; content:"|07|gay-gay|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalwat.com (Malware_Distribution)"; content:"|09|globalwat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gysh.es.kr (Malware_Distribution)"; content:"|04|gysh|02|es|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howtokisslogs.ws (Malware_Infectors)"; content:"|0d|howtokisslogs|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hstcorp.co.kr (Malware_Distribution)"; content:"|07|hstcorp|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagempps.webng.com (Malware_Infectors)"; content:"|09|imagempps|05|webng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgccc.net (Malware_Distribution)"; content:"|06|imgccc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgeee.net (Malware_Distribution)"; content:"|06|imgeee|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inscribete.org (Malware_Infectors)"; content:"|0a|inscribete|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joeniekrofoundation.com (Malware_Infectors)"; content:"|13|joeniekrofoundation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juicyjunction.com (Malware_Infectors)"; content:"|0d|juicyjunction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcp.fileave.com (Malware_Infectors)"; content:"|03|kcp|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kinkalbrass.cz (Malware_Infectors)"; content:"|0b|kinkalbrass|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kirster.in (Malware_Infectors)"; content:"|07|kirster|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klinexx.com (Malware_Infectors)"; content:"|07|klinexx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup landvermesser.tripod.com (Malware_Infectors)"; content:"|0d|landvermesser|06|tripod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup link1030.com (Malware_Distribution)"; content:"|08|link1030|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lntsaddles.com (Malware_Infectors)"; content:"|0a|lntsaddles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadcash.biz (Malware_Infectors)"; content:"|08|loadcash|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2603422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcrenox.com.ar (Malware_Infectors)"; content:"|07|mcrenox|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mechauffeur.com.au (Malware_Distribution)"; content:"|0b|mechauffeur|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memoryscannerantiv.com (Spyware)"; content:"|12|memoryscannerantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memoryscannerprotectionfast.com (Spyware)"; content:"|1b|memoryscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memoryscannerprotectionfree.com (Spyware)"; content:"|1b|memoryscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memoryscannerprotectionwin.com (Spyware)"; content:"|1a|memoryscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memoryscannerprotectionxp.com (Spyware)"; content:"|19|memoryscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memoryscannerwinprotection.com (Spyware)"; content:"|1a|memoryscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memoryscannerxpprotection.com (Spyware)"; content:"|19|memoryscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobilescannerprotectionfree.com (Spyware)"; content:"|1b|mobilescannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobilescannerprotectionwin.com (Spyware)"; content:"|1a|mobilescannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobilescannerprotectionxp.com (Spyware)"; content:"|19|mobilescannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobilescannerwinprotection.com (Spyware)"; content:"|1a|mobilescannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobilescannerxpprotection.com (Spyware)"; content:"|19|mobilescannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morllaines.com (Malware_Infectors)"; content:"|0a|morllaines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mumayi.net (Malware_Infectors)"; content:"|06|mumayi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantiviruzscanner.com (Fake_AV)"; content:"|12|myantiviruzscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantiviruzscannerxp.com (Fake_AV)"; content:"|14|myantiviruzscannerxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup negativescannerprotectionfree.com (Spyware)"; content:"|1d|negativescannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup negativescannerprotectionwin.com (Spyware)"; content:"|1c|negativescannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup negativescannerprotectionxp.com (Spyware)"; content:"|1b|negativescannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup negativescannerwinprotection.com (Spyware)"; content:"|1c|negativescannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup negativescannerxpprotection.com (Spyware)"; content:"|1b|negativescannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newantiviruzscanner.com (Fake_AV)"; content:"|13|newantiviruzscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newantiviruzscannerxp.com (Fake_AV)"; content:"|15|newantiviruzscannerxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nikold.ru (Zeus_Zbot_SpyEye)"; content:"|06|nikold|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-alert-policy62.co.cc (Malware_Distribution)"; content:"|15|online-alert-policy62|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parti13.co.cc (Malware_Infectors)"; content:"|07|parti13|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup payrollserversinstall.com (Malware_Infectors)"; content:"|15|payrollserversinstall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-soft1.com (Fake_AV)"; content:"|0e|pc-guard-soft1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-soft2.net (Fake_AV)"; content:"|0e|pc-guard-soft2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-soft3.com (Fake_AV)"; content:"|0e|pc-guard-soft3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-soft4.net (Fake_AV)"; content:"|0e|pc-guard-soft4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-soft5.com (Fake_AV)"; content:"|0e|pc-guard-soft5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-soft6.net (Fake_AV)"; content:"|0e|pc-guard-soft6|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-soft7.com (Fake_AV)"; content:"|0e|pc-guard-soft7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-soft8.net (Fake_AV)"; content:"|0e|pc-guard-soft8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanbest1.com (Fake_AV)"; content:"|0c|pc-scanbest1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanbest2.net (Fake_AV)"; content:"|0c|pc-scanbest2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanbest3.com (Fake_AV)"; content:"|0c|pc-scanbest3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanbest4.net (Fake_AV)"; content:"|0c|pc-scanbest4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanbest5.com (Fake_AV)"; content:"|0c|pc-scanbest5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanbest6.net (Fake_AV)"; content:"|0c|pc-scanbest6|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanbest7.com (Fake_AV)"; content:"|0c|pc-scanbest7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanbest8.net (Fake_AV)"; content:"|0c|pc-scanbest8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petbabbledog.com (Malware_Distribution)"; content:"|0c|petbabbledog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnmli.info (Malware_Infectors)"; content:"|05|pnmli|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rapidstream.biz (Malware_Distribution)"; content:"|0b|rapidstream|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reports-4-u.com (Malware_Infectors)"; content:"|0b|reports-4-u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reserve11.com (Zeus_Zbot_SpyEye)"; content:"|09|reserve11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roozero.net (Malware_Distribution)"; content:"|07|roozero|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rs2merchants.net (Malware_Infectors)"; content:"|0c|rs2merchants|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rubbikcube.net.in (Malware_Distribution)"; content:"|0a|rubbikcube|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruprostitutki.ru (Malware_Infectors)"; content:"|0d|ruprostitutki|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ry-projector-accessories.com (Malware_Infectors)"; content:"|18|ry-projector-accessories|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s5c4.net (Spyware)"; content:"|04|s5c4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scarts.name (Zeus_Zbot_SpyEye)"; content:"|06|scarts|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secguard.biz (Malware_Distribution)"; content:"|08|secguard|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sellertop.cn.com (Zeus_Zbot_SpyEye)"; content:"|09|sellertop|02|cn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup semenov.ru (Malware_Distribution)"; content:"|07|semenov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sheild-andpowetool.com (Fake_AV)"; content:"|12|sheild-andpowetool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shelter-keeper-soft.com (Fake_AV)"; content:"|13|shelter-keeper-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shieldavsoft.com (Fake_AV)"; content:"|0c|shieldavsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shup.com (Malware_Infectors)"; content:"|04|shup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup signalpaper.com (Malware_Infectors)"; content:"|0b|signalpaper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simple-antivir-soft.net (Fake_AV)"; content:"|13|simple-antivir-soft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simple-guardin-foryou.net (Fake_AV)"; content:"|15|simple-guardin-foryou|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simple-onlysentinel.net (Fake_AV)"; content:"|13|simple-onlysentinel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simpleclean-checker.com (Fake_AV)"; content:"|13|simpleclean-checker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simplecleansentinel.com (Fake_AV)"; content:"|13|simplecleansentinel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simplenetwork-guard.com (Fake_AV)"; content:"|13|simplenetwork-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simplesecuritymaster.com (Fake_AV)"; content:"|14|simplesecuritymaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-cleanarmy.net (Fake_AV)"; content:"|0f|smart-cleanarmy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-drive-checker.com (Fake_AV)"; content:"|13|smart-drive-checker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-drivekeeper.com (Fake_AV)"; content:"|11|smart-drivekeeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-file-keeper.com (Fake_AV)"; content:"|11|smart-file-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-fileguard.com (Fake_AV)"; content:"|0f|smart-fileguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-ineternetsecurity.com (Fake_AV)"; content:"|17|smart-ineternetsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-internet-army.net (Fake_AV)"; content:"|13|smart-internet-army|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-internet-holder.net (Fake_AV)"; content:"|15|smart-internet-holder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-internetforyou.net (Fake_AV)"; content:"|14|smart-internetforyou|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-network-holder.com (Fake_AV)"; content:"|14|smart-network-holder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-network-scanner.com (Fake_AV)"; content:"|15|smart-network-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-networksoft.com (Fake_AV)"; content:"|11|smart-networksoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-only-scanner.com (Fake_AV)"; content:"|12|smart-only-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-pc-keeper.com (Fake_AV)"; content:"|0f|smart-pc-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-pc-keeper.net (Fake_AV)"; content:"|0f|smart-pc-keeper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-pcguard.com (Fake_AV)"; content:"|0d|smart-pcguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-pckeeper.net (Fake_AV)"; content:"|0e|smart-pckeeper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-security-guard.com (Fake_AV)"; content:"|14|smart-security-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-security-guard.net (Fake_AV)"; content:"|14|smart-security-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-security-soft.com (Fake_AV)"; content:"|13|smart-security-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-security70.com (Fake_AV)"; content:"|10|smart-security70|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-security71.com (Fake_AV)"; content:"|10|smart-security71|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-security72.com (Fake_AV)"; content:"|10|smart-security72|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-security73.com (Fake_AV)"; content:"|10|smart-security73|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-securitychecker.com (Fake_AV)"; content:"|15|smart-securitychecker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-securityforu.net (Fake_AV)"; content:"|12|smart-securityforu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-securityscanner.net (Fake_AV)"; content:"|15|smart-securityscanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-stuffholder.net (Fake_AV)"; content:"|11|smart-stuffholder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-stuffmaster.com (Fake_AV)"; content:"|11|smart-stuffmaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-stuffmaster.net (Fake_AV)"; content:"|11|smart-stuffmaster|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-virusearcher50.com (Fake_AV)"; content:"|14|smart-virusearcher50|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-virusearcher51.com (Fake_AV)"; content:"|14|smart-virusearcher51|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-virusearcher52.com (Fake_AV)"; content:"|14|smart-virusearcher52|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-virusearcher53.com (Fake_AV)"; content:"|14|smart-virusearcher53|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-virusearcher54.com (Fake_AV)"; content:"|14|smart-virusearcher54|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-virusearcher55.com (Fake_AV)"; content:"|14|smart-virusearcher55|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-your-keeper.com (Fake_AV)"; content:"|11|smart-your-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-yourguard.com (Fake_AV)"; content:"|0f|smart-yourguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-yourguard.net (Fake_AV)"; content:"|0f|smart-yourguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart2xchange.ru ()"; content:"|0d|smart2xchange|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartantivirsoft.net (Fake_AV)"; content:"|10|smartantivirsoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartclean-holder.net (Fake_AV)"; content:"|11|smartclean-holder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft2011.co.uk (Malware_Infectors)"; content:"|08|soft2011|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solutionofavprotection.com (Fake_AV)"; content:"|16|solutionofavprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup specialprotectionav.com (Fake_AV)"; content:"|13|specialprotectionav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spiderfile.net (Malware_Distribution)"; content:"|0a|spiderfile|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stable-protectionsoft.com (Fake_AV)"; content:"|15|stable-protectionsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stablenetprotection-in.net (Fake_AV)"; content:"|16|stablenetprotection-in|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stablepotection-av.com (Fake_AV)"; content:"|12|stablepotection-av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup start-protectionav.com (Fake_AV)"; content:"|12|start-protectionav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup static2011online-search.in (Malware_Infectors)"; content:"|17|static2011online-search|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-guard21.com (Fake_AV)"; content:"|0e|strong-guard21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-guard22.com (Fake_AV)"; content:"|0e|strong-guard22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-guard23.com (Fake_AV)"; content:"|0e|strong-guard23|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-guard24.com (Fake_AV)"; content:"|0e|strong-guard24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-guard25.com (Fake_AV)"; content:"|0e|strong-guard25|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-guard26.com (Fake_AV)"; content:"|0e|strong-guard26|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-guardin-soft.com (Fake_AV)"; content:"|13|strong-guardin-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-network-master.com (Fake_AV)"; content:"|15|strong-network-master|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-power-defense5.net (Fake_AV)"; content:"|15|strong-power-defense5|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subjectssummer.com (Malware_Distribution)"; content:"|0e|subjectssummer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t-codec.com (Malware_Infectors)"; content:"|07|t-codec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tgces.co.cc (Malware_Infectors)"; content:"|05|tgces|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebugeraser.com (Malware_Infectors)"; content:"|0c|thebugeraser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tomsan.ru (Zeus_Zbot_SpyEye)"; content:"|06|tomsan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twididn.com (Malware_Distribution)"; content:"|07|twididn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twilanefi.com (Malware_Distribution)"; content:"|09|twilanefi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typessubject.com (Malware_Distribution)"; content:"|0c|typessubject|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup udjng.info (Malware_Infectors)"; content:"|05|udjng|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhncs.info (Malware_Infectors)"; content:"|05|uhncs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unt-antivirus.ce.ms (Fake_AV)"; content:"|0d|unt-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdub.fileave.com (Malware_Infectors)"; content:"|04|vdub|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videohornetvide.com (Zeus_Zbot_SpyEye)"; content:"|0f|videohornetvide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vituli.ru (Zeus_Zbot_SpyEye)"; content:"|06|vituli|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wagabb.com (Malware_Infectors)"; content:"|06|wagabb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waper.ru (Malware_Infectors)"; content:"|05|waper|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wavescale.net (Malware_Infectors)"; content:"|09|wavescale|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webfamba.com (Malware_Distribution)"; content:"|08|webfamba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webunddesign.info (Malware_Distribution)"; content:"|0c|webunddesign|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup www.deu.edu.tr (Malware_Infectors)"; content:"|03|www|03|deu|03|edu|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wylt.net (Malware_Infectors)"; content:"|04|wylt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xinghaimoto.com (Malware_Distribution)"; content:"|0b|xinghaimoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yebom.co.kr (Malware_Distribution)"; content:"|05|yebom|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chiangmaiporcelain.com (Malware_Distribution)"; content:"|12|chiangmaiporcelain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-hak.co.kr (Malware_Distribution)"; content:"|05|e-hak|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup see.webphoto.ir (Malware_Distribution)"; content:"|03|see|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tearsofsun.oz.pl (Malware_Distribution)"; content:"|0a|tearsofsun|02|oz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a1marketingteam.net (Malware_Distribution)"; content:"|0f|a1marketingteam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolaaderinto.com (Malware_Distribution)"; content:"|0c|kolaaderinto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pwoot.fr (Malware_Distribution)"; content:"|05|pwoot|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrsalesandnetworking.com (Malware_Distribution)"; content:"|14|vrsalesandnetworking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arfo.com.br (Malware_Distribution)"; content:"|04|arfo|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonodesign.co.kr (Malware_Distribution)"; content:"|0a|bonodesign|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scripts.cgispy.com (Malware_Distribution)"; content:"|07|scripts|06|cgispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yullee.co.kr (Malware_Distribution)"; content:"|06|yullee|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 123tagged.com (Zeus_Zbot_SpyEye)"; content:"|09|123tagged|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abmarchitects.com (Malware_Distribution)"; content:"|0d|abmarchitects|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admineye1.com (Malware_Distribution)"; content:"|09|admineye1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afepqbrylo.ru (Malware_Distribution)"; content:"|0a|afepqbrylo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asia-news100.com (Malware_Distribution)"; content:"|0c|asia-news100|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup az-antivirus.ce.ms (Fake_AV)"; content:"|0c|az-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baidunhf.com (Malware_Distribution)"; content:"|08|baidunhf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bervb.com (Malware_Distribution)"; content:"|05|bervb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best1banners.com (Malware_Distribution)"; content:"|0c|best1banners|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bofmedic.com (Malware_Infectors)"; content:"|08|bofmedic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buygoilkef.ru (Malware_Distribution)"; content:"|0a|buygoilkef|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cgfoyekuzj.ru (Malware_Distribution)"; content:"|0a|cgfoyekuzj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codescannerantiv.com (Spyware)"; content:"|10|codescannerantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codescannerprotectionfast.com (Spyware)"; content:"|19|codescannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codescannerprotectionfree.com (Spyware)"; content:"|19|codescannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codescannerprotectionwin.com (Spyware)"; content:"|18|codescannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codescannerprotectionxp.com (Spyware)"; content:"|17|codescannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codescannerwinprotection.com (Spyware)"; content:"|18|codescannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codescannerxpprotection.com (Spyware)"; content:"|17|codescannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colorscannerantiv.com (Spyware)"; content:"|11|colorscannerantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colorscannerprotectionfast.com (Spyware)"; content:"|1a|colorscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colorscannerprotectionfree.com (Spyware)"; content:"|1a|colorscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colorscannerprotectionwin.com (Spyware)"; content:"|19|colorscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colorscannerprotectionxp.com (Spyware)"; content:"|18|colorscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colorscannerwinprotection.com (Spyware)"; content:"|19|colorscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colorscannerxpprotection.com (Spyware)"; content:"|18|colorscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colourscanprotectionxp.com (Spyware)"; content:"|16|colourscanprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compactscannerantiv.com (Spyware)"; content:"|13|compactscannerantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compactscannerprotectionfast.com (Spyware)"; content:"|1c|compactscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compactscannerprotectionfree.com (Spyware)"; content:"|1c|compactscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfkdoirrsaxasods.ru (Malware_Distribution)"; content:"|10|dfkdoirrsaxasods|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhuz.info (Malware_Distribution)"; content:"|04|dhuz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dkbq.info (Malware_Distribution)"; content:"|04|dkbq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup documentscannerprotectionfast.com (Spyware)"; content:"|1d|documentscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup documentscannerprotectionfree.com (Spyware)"; content:"|1d|documentscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup documentscannerprotectionwin.com (Spyware)"; content:"|1c|documentscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup documentscannerprotectionxp.com (Spyware)"; content:"|1b|documentscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup documentscannerwinprotection.com (Spyware)"; content:"|1c|documentscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup documentscannerxpprotection.com (Spyware)"; content:"|1b|documentscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dushko.net (Zeus_Zbot_SpyEye)"; content:"|06|dushko|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emmb.info (Malware_Distribution)"; content:"|04|emmb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup equal-protection-ant-iv-scan-xp.com (Spyware)"; content:"|1f|equal-protection-ant-iv-scan-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup equalprotectionantivscanxp.com (Spyware)"; content:"|1a|equalprotectionantivscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erosway.com (Malware_Distribution)"; content:"|07|erosway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everylittlethingshedoes.info (Malware_Distribution)"; content:"|17|everylittlethingshedoes|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotocrak.com (Malware_Distribution)"; content:"|08|fotocrak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-win-laser-scan-antivir.com (Fake_AV)"; content:"|1b|free-win-laser-scan-antivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-win-lung-scan-antivir.com (Fake_AV)"; content:"|1a|free-win-lung-scan-antivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-win-quick-scan-antivir.com (Fake_AV)"; content:"|1b|free-win-quick-scan-antivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-win-scan-antivir.com (Fake_AV)"; content:"|15|free-win-scan-antivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freediagnosticscannerprotection.com (Spyware)"; content:"|1f|freediagnosticscannerprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewinbonescanantivir.com (Fake_AV)"; content:"|16|freewinbonescanantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewinscanantivir.com (Fake_AV)"; content:"|12|freewinscanantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewinvirusscanantivir.com (Fake_AV)"; content:"|17|freewinvirusscanantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g450.in (Malware_Distribution)"; content:"|04|g450|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabtag.net (Malware_Distribution)"; content:"|06|gabtag|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghmnl.info (Malware_Distribution)"; content:"|05|ghmnl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golovushka.net (Zeus_Zbot_SpyEye)"; content:"|0a|golovushka|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubabe.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubabe|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubabu.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubabu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubaib.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubaib|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubaoh.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubaoh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubczj.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubczj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubeiw.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubeiw|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubemh.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubemh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubfgl.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubfgl|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubfvf.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubfvf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubfxa.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubfxa|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubgdl.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubgdl|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubggm.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubggm|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubgmt.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubgmt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubhdv.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubhdv|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubhmt.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubhmt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubiag.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubiag|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubioo.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubioo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubjoz.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubjoz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubjpb.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubjpb|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubkhf.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubkhf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubkku.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubkku|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubkmi.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubkmi|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshublqh.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshublqh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshublrf.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshublrf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshublsc.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshublsc|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubltm.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubltm|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshublvc.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshublvc|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubmow.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubmow|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubmpd.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubmpd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubnck.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubnck|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubnjn.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubnjn|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubnta.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubnta|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubone.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubone|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshuboxu.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshuboxu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubpex.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubpex|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubqkj.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubqkj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubqrt.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubqrt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubqve.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubqve|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubqww.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubqww|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubqzq.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubqzq|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubrba.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubrba|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubrql.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubrql|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubrry.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubrry|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubrwt.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubrwt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubsht.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubsht|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubtef.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubtef|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubtsg.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubtsg|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubtxp.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubtxp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubuay.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubuay|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubuhi.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubuhi|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubwcj.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubwcj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubwgx.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubwgx|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubwyf.co.cc (Malware_Distribution)"; content:"|0e|hdxclipshubwyf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubxfu.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubxfu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubxph.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubxph|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubyrf.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubyrf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubzkg.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubzkg|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxclipshubzzq.co.cc (Malware_Infectors)"; content:"|0e|hdxclipshubzzq|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hornalfa.com (Malware_Distribution)"; content:"|08|hornalfa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horrys.in (Malware_Infectors)"; content:"|06|horrys|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsey.info (Malware_Distribution)"; content:"|04|hsey|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpsea.com (Malware_Distribution)"; content:"|07|httpsea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagescannerantiv.com (Spyware)"; content:"|11|imagescannerantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagescannerprotectionfast.com (Spyware)"; content:"|1a|imagescannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagescannerprotectionfree.com (Spyware)"; content:"|1a|imagescannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagescannerprotectionwin.com (Spyware)"; content:"|19|imagescannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagescannerprotectionxp.com (Spyware)"; content:"|18|imagescannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inetspeedup.com (Malware_Distribution)"; content:"|0b|inetspeedup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infoxkmdrg.ru (Malware_Distribution)"; content:"|0a|infoxkmdrg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intermediacorp.org (Malware_Distribution)"; content:"|0e|intermediacorp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipchecker001.com (Malware_Distribution)"; content:"|0c|ipchecker001|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irishel.in (Malware_Distribution)"; content:"|07|irishel|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j-fond.ru (Malware_Distribution)"; content:"|06|j-fond|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jefotherbld.com (Malware_Distribution)"; content:"|0b|jefotherbld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klassess.com (Malware_Distribution)"; content:"|08|klassess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kupimesto.ru (Malware_Distribution)"; content:"|09|kupimesto|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup licenseacquisition.org (Malware_Distribution)"; content:"|12|licenseacquisition|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liverscanprotectionsoft.com (Spyware)"; content:"|17|liverscanprotectionsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liverscanprotectionxp.com (Spyware)"; content:"|15|liverscanprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lock.cpapath.com (Malware_Distribution)"; content:"|04|lock|07|cpapath|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lungscanprotectionsoft.com (Spyware)"; content:"|16|lungscanprotectionsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marksandco.net (Malware_Distribution)"; content:"|0a|marksandco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maxthirds.com (Malware_Distribution)"; content:"|09|maxthirds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members.ozemail.com.au (Malware_Distribution)"; content:"|07|members|07|ozemail|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moresonline.com (Malware_Distribution)"; content:"|0b|moresonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycentinder.com (Malware_Distribution)"; content:"|0b|mycentinder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myflipjam.com (Malware_Distribution)"; content:"|09|myflipjam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysdt.in (Malware_Distribution)"; content:"|05|mysdt|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namebrend.ru (Malware_Distribution)"; content:"|09|namebrend|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naurup.com (Malware_Distribution)"; content:"|06|naurup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njkfq.com (Malware_Distribution)"; content:"|05|njkfq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntukjgozxy.ru (Malware_Distribution)"; content:"|0a|ntukjgozxy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ojsfcpabwm.ru (Malware_Distribution)"; content:"|0a|ojsfcpabwm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup owsx.co.cc (Malware_Distribution)"; content:"|04|owsx|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paradeo.com (Malware_Distribution)"; content:"|07|paradeo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup passportsoftvi.ru (Malware_Distribution)"; content:"|0e|passportsoftvi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petmovea.com (Malware_Distribution)"; content:"|08|petmovea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoscannerprotectionfast.com (Spyware)"; content:"|1a|photoscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoscannerprotectionfree.com (Spyware)"; content:"|1a|photoscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoscannerprotectionwin.com (Spyware)"; content:"|19|photoscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promosyongazetesi.com (Malware_Distribution)"; content:"|11|promosyongazetesi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prosafeinside.co.cc (Malware_Distribution)"; content:"|0d|prosafeinside|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rotyjigibano.ru (Malware_Distribution)"; content:"|0c|rotyjigibano|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-all.com (Malware_Distribution)"; content:"|08|safe-all|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samborai.com (Malware_Distribution)"; content:"|08|samborai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanagainantivirus.com (Fake_AV)"; content:"|12|scanagainantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanagainantivirussolution.com (Fake_AV)"; content:"|1a|scanagainantivirussolution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanagainantivirussolutions.com (Fake_AV)"; content:"|1b|scanagainantivirussolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantcolonyivfree.com (Spyware)"; content:"|13|scanantcolonyivfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivirusvwin.com (Fake_AV)"; content:"|11|scanantivirusvwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivwdealersin.com (Spyware)"; content:"|13|scanantivwdealersin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivwenginesin.com (Spyware)"; content:"|13|scanantivwenginesin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivwgolfin.com (Spyware)"; content:"|10|scanantivwgolfin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivwin.com (Spyware)"; content:"|0c|scanantivwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureamas.com (Fake_AV)"; content:"|0a|secureamas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureame.com (Fake_AV)"; content:"|09|secureame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureara.com (Fake_AV)"; content:"|09|secureara|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureawd.com (Fake_AV)"; content:"|09|secureawd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureaxle.com (Fake_AV)"; content:"|0a|secureaxle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureaze.com (Fake_AV)"; content:"|09|secureaze|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securebritartpc.net (Fake_AV)"; content:"|0f|securebritartpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securebtus.com (Fake_AV)"; content:"|0a|securebtus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securebum.com (Fake_AV)"; content:"|09|securebum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securecaty.com (Fake_AV)"; content:"|0a|securecaty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securechin.com (Fake_AV)"; content:"|0a|securechin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securecoe.com (Fake_AV)"; content:"|09|securecoe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securecys.com (Fake_AV)"; content:"|09|securecys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securedjer.com (Fake_AV)"; content:"|0a|securedjer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securedyl.com (Fake_AV)"; content:"|09|securedyl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selfhost.nl (Spyware)"; content:"|08|selfhost|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smaksoft.ru (Malware_Distribution)"; content:"|08|smaksoft|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-power-defense6.net (Fake_AV)"; content:"|15|strong-power-defense6|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stx.nl (Spyware)"; content:"|03|stx|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swt.sawankalok.go.th (Malware_Distribution)"; content:"|03|swt|0a|sawankalok|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-file-keeper.net (Fake_AV)"; content:"|0f|top-file-keeper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-filemaster.com (Fake_AV)"; content:"|0e|top-filemaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-guardin-master.com (Fake_AV)"; content:"|12|top-guardin-master|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-internet-scanner.com (Fake_AV)"; content:"|14|top-internet-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-internetforu.com (Fake_AV)"; content:"|10|top-internetforu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-internetforyou.com (Fake_AV)"; content:"|12|top-internetforyou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-internetguard.com (Fake_AV)"; content:"|11|top-internetguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-only-foryou.com (Fake_AV)"; content:"|0f|top-only-foryou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-only-scanner.com (Fake_AV)"; content:"|10|top-only-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-pcguard.com (Fake_AV)"; content:"|0b|top-pcguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topwebvorlagen.de (Malware_Distribution)"; content:"|0e|topwebvorlagen|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup txtpui1224.orge.pl (Spyware)"; content:"|0a|txtpui1224|04|orge|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgob.infosky-protection.com (Spyware)"; content:"|04|vgob|12|infosky-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wattoo.biz (Malware_Distribution)"; content:"|06|wattoo|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weatherxml.net (Malware_Distribution)"; content:"|0a|weatherxml|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wellcheckmypower.info (Malware_Distribution)"; content:"|10|wellcheckmypower|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup werlijokityp.com (Malware_Distribution)"; content:"|0c|werlijokityp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winkbuzz.net (Malware_Distribution)"; content:"|08|winkbuzz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnoayieqpz.ru (Malware_Distribution)"; content:"|0a|wnoayieqpz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xonuhoregovi.ru (Malware_Distribution)"; content:"|0c|xonuhoregovi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0313879956.kt.io (Malware_Distribution)"; content:"|0a|0313879956|02|kt|02|io"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babag.org (Malware_Distribution)"; content:"|05|babag|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besteshoponline.com (Malware_Distribution)"; content:"|0f|besteshoponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chicago-webdesign.net (Malware_Distribution)"; content:"|11|chicago-webdesign|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datanet.hu (Malware_Distribution)"; content:"|07|datanet|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drakan.ru (Malware_Distribution)"; content:"|06|drakan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duygusalforum.net (Malware_Distribution)"; content:"|0d|duygusalforum|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golovazastrala.com (Malware_Distribution)"; content:"|0e|golovazastrala|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greensny.com (Malware_Distribution)"; content:"|08|greensny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herkesbilmez.com (Malware_Distribution)"; content:"|0c|herkesbilmez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakshmiinfotech.com (Malware_Distribution)"; content:"|0f|lakshmiinfotech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkdirect.co.kr (Malware_Distribution)"; content:"|0a|linkdirect|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveboan.co.kr (Malware_Distribution)"; content:"|08|liveboan|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loxblog.com (Malware_Distribution)"; content:"|07|loxblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maskad.net (Malware_Distribution)"; content:"|06|maskad|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup needservices.org (Malware_Distribution)"; content:"|0c|needservices|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oneeyedflush.com (Malware_Distribution)"; content:"|0c|oneeyedflush|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planetnemo.com (Malware_Distribution)"; content:"|0a|planetnemo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup postotiozico.com.br (Malware_Distribution)"; content:"|0c|postotiozico|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quadisiyya.com (Malware_Distribution)"; content:"|0a|quadisiyya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamiljugend.ch (Malware_Distribution)"; content:"|0b|tamiljugend|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tutorialstorm.com (Malware_Distribution)"; content:"|0d|tutorialstorm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup volatilerecordings.com (Malware_Distribution)"; content:"|12|volatilerecordings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xufu9.com (Malware_Distribution)"; content:"|05|xufu9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afford-uk.org (Malware_Distribution)"; content:"|09|afford-uk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxhouse.co.kr (Malware_Distribution)"; content:"|08|foxhouse|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kentwoodprep.freehostia.com (Malware_Distribution)"; content:"|0c|kentwoodprep|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phonakfm.co.kr (Malware_Distribution)"; content:"|08|phonakfm|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ronal-russia.com (Malware_Distribution)"; content:"|0c|ronal-russia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0tdsgov.co.cc (Malware_Distribution)"; content:"|07|0tdsgov|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 13tdsgov.co.cc (Malware_Distribution)"; content:"|08|13tdsgov|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1tdsgov.co.cc (Malware_Distribution)"; content:"|07|1tdsgov|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 22tdsgov.co.cc (Malware_Distribution)"; content:"|08|22tdsgov|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 23tdsgov.co.cc (Malware_Distribution)"; content:"|08|23tdsgov|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7hitaxodupi.com (Phishing_and_Theft)"; content:"|0b|7hitaxodupi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 99ip.ru (Malware_Distribution)"; content:"|04|99ip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alolipololi.osa.pl (Malware_Distribution)"; content:"|0b|alolipololi|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirbestscan.com (Fake_AV)"; content:"|0f|antivirbestscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestnacha-site-r.info (Malware_Distribution)"; content:"|10|bestnacha-site-r|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsoftquestnus.net (Fake_AV)"; content:"|10|bestsoftquestnus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsoftwurass.net (Fake_AV)"; content:"|0e|bestsoftwurass|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beststuff-master.net (Fake_AV)"; content:"|10|beststuff-master|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bivudywigana.com (Spyware)"; content:"|0c|bivudywigana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bkzbkzz.co.cc (Malware_Distribution)"; content:"|07|bkzbkzz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bkzblbk.co.cc (Malware_Distribution)"; content:"|07|bkzblbk|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu0.com (Zeus_Zbot_SpyEye)"; content:"|06|bndeu0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu1.com (Zeus_Zbot_SpyEye)"; content:"|06|bndeu1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu2.com (Zeus_Zbot_SpyEye)"; content:"|06|bndeu2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu3.com (Zeus_Zbot_SpyEye)"; content:"|06|bndeu3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu4.com (Zeus_Zbot_SpyEye)"; content:"|06|bndeu4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu5.com (Zeus_Zbot_SpyEye)"; content:"|06|bndeu5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu6.com (Zeus_Zbot_SpyEye)"; content:"|06|bndeu6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu7.com (Zeus_Zbot_SpyEye)"; content:"|06|bndeu7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu8.com (Zeus_Zbot_SpyEye)"; content:"|06|bndeu8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bndeu9.com (Malware_Distribution)"; content:"|06|bndeu9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciluvekypomow.com (Phishing_and_Theft)"; content:"|0d|ciluvekypomow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compactscannerprotectionwin.com (Spyware)"; content:"|1b|compactscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compactscannerprotectionxp.com (Spyware)"; content:"|1a|compactscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compactscannerwinprotection.com (Spyware)"; content:"|1b|compactscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compactscannerxpprotection.com (Spyware)"; content:"|1a|compactscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup consumer-protection-ant-iv-scan-xp.com (Spyware)"; content:"|22|consumer-protection-ant-iv-scan-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup consumerprotectionantivscanxp.com (Spyware)"; content:"|1d|consumerprotectionantivscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup copy-protection-ant-iv-scan-xp.com (Spyware)"; content:"|1e|copy-protection-ant-iv-scan-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup copyprotectionantivscanxp.com (Spyware)"; content:"|19|copyprotectionantivscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup copyright-protection-ant-iv-scan-xp.com (Spyware)"; content:"|23|copyright-protection-ant-iv-scan-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup copyrightprotectionantivscanxp.com (Spyware)"; content:"|1e|copyrightprotectionantivscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktopscannerantiv.com (Spyware)"; content:"|13|desktopscannerantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktopscannerprotectionfast.com (Spyware)"; content:"|1c|desktopscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktopscannerprotectionfree.com (Spyware)"; content:"|1c|desktopscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktopscannerprotectionwin.com (Spyware)"; content:"|1b|desktopscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktopscannerprotectionxp.com (Spyware)"; content:"|1a|desktopscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktopscannerwinprotection.com (Spyware)"; content:"|1b|desktopscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktopscannerxpprotection.com (Spyware)"; content:"|1a|desktopscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dexojovahazyla.com (Spyware)"; content:"|0e|dexojovahazyla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dinifuxariqi.com (Spyware)"; content:"|0c|dinifuxariqi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dioasis.com (Malware_Distribution)"; content:"|07|dioasis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dltbkbb.co.cc (Malware_Distribution)"; content:"|07|dltbkbb|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dojewoboji.com (Spyware)"; content:"|0a|dojewoboji|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dulyfarebacuf.com (Spyware)"; content:"|0d|dulyfarebacuf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dygydypinynyx.com (Spyware)"; content:"|0d|dygydypinynyx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eadied.net (Malware_Distribution)"; content:"|06|eadied|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exposedexbfs.com (Malware_Distribution)"; content:"|0c|exposedexbfs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fepigixypo.com (Phishing_and_Theft)"; content:"|0a|fepigixypo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fequxukovo.com (Phishing_and_Theft)"; content:"|0a|fequxukovo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-stuffmaster.net (Fake_AV)"; content:"|10|fine-stuffmaster|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-your-guard.net (Fake_AV)"; content:"|0f|fine-your-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-your-keeper.com (Fake_AV)"; content:"|10|fine-your-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-yourguard.net (Fake_AV)"; content:"|0e|fine-yourguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finedrive-guard.com (Fake_AV)"; content:"|0f|finedrive-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finedriveholder.net (Fake_AV)"; content:"|0f|finedriveholder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finedrivekeeper.net (Fake_AV)"; content:"|0f|finedrivekeeper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finefileguard.com (Fake_AV)"; content:"|0d|finefileguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finepc-holder.com (Fake_AV)"; content:"|0d|finepc-holder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finepc-keeper.com (Fake_AV)"; content:"|0d|finepc-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fowyqypacytucy.com (Phishing_and_Theft)"; content:"|0e|fowyqypacytucy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gedynehyze.com (Spyware)"; content:"|0a|gedynehyze|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gehotigyry.com (Phishing_and_Theft)"; content:"|0a|gehotigyry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gewexyvunokyk.com (Phishing_and_Theft)"; content:"|0d|gewexyvunokyk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gocubadywucyle.com (Spyware)"; content:"|0e|gocubadywucyle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup govtds30.co.cc (Malware_Distribution)"; content:"|08|govtds30|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedily.com (Fake_AV)"; content:"|0a|guardedily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedise.com (Fake_AV)"; content:"|0a|guardedise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedlart.com (Fake_AV)"; content:"|0b|guardedlart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardedmis.com (Fake_AV)"; content:"|0a|guardedmis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardforpc-solutions.com (Fake_AV)"; content:"|14|guardforpc-solutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardian-lab-soft.com (Fake_AV)"; content:"|11|guardian-lab-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardian1-forsec.com (Fake_AV)"; content:"|10|guardian1-forsec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardiansec-all.com (Fake_AV)"; content:"|0f|guardiansec-all|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardrchiticpc.com (Fake_AV)"; content:"|0e|guardrchiticpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardsuclonpc.net (Fake_AV)"; content:"|0d|guardsuclonpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardsuryousepc.com (Fake_AV)"; content:"|0f|guardsuryousepc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guarduggisspc.net (Fake_AV)"; content:"|0d|guarduggisspc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gurydivadu.com (Spyware)"; content:"|0a|gurydivadu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gygipikalyn.com (Phishing_and_Theft)"; content:"|0b|gygipikalyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gyrahakita.com (Spyware)"; content:"|0a|gyrahakita|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gyricehagupy.com (Phishing_and_Theft)"; content:"|0c|gyricehagupy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gyxyqimacik.com (Phishing_and_Theft)"; content:"|0b|gyxyqimacik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haeied.net (Malware_Distribution)"; content:"|06|haeied|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahecekis.com (Spyware)"; content:"|09|hahecekis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahecekis.net (Malware_Distribution)"; content:"|09|hahecekis|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hand-bending.com (Malware_Distribution)"; content:"|0c|hand-bending|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hijocyragap.com (Phishing_and_Theft)"; content:"|0b|hijocyragap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hireremexyd.com (Spyware)"; content:"|0b|hireremexyd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitaxodupi.com (Spyware)"; content:"|0a|hitaxodupi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsd4hrehdh.vv.cc (Malware_Distribution)"; content:"|0a|hsd4hrehdh|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huzomohidid.com (Phishing_and_Theft)"; content:"|0b|huzomohidid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intelbackupsrv.su (Malware_Distribution)"; content:"|0e|intelbackupsrv|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivonica.com (Malware_Distribution)"; content:"|07|ivonica|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jackman-consortium.com (Malware_Distribution)"; content:"|12|jackman-consortium|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jajypyzuzidepo.com (Spyware)"; content:"|0e|jajypyzuzidepo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jgjs5jfhdkh.vv.cc (Malware_Distribution)"; content:"|0b|jgjs5jfhdkh|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jijekoramukiw.com (Spyware)"; content:"|0d|jijekoramukiw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jvcprocessos.com (Malware_Distribution)"; content:"|0c|jvcprocessos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jydosucin.com (Phishing_and_Theft)"; content:"|09|jydosucin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyluzovunevu.com (Phishing_and_Theft)"; content:"|0c|jyluzovunevu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kelacofotacafo.com (Spyware)"; content:"|0e|kelacofotacafo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kkojjors.net (Phishing_and_Theft)"; content:"|08|kkojjors|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koduzuwobow.com (Phishing_and_Theft)"; content:"|0b|koduzuwobow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup komeriqoxuri.com (Spyware)"; content:"|0c|komeriqoxuri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ku3.in (Malware_Distribution)"; content:"|03|ku3|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laiaed.net (Malware_Distribution)"; content:"|06|laiaed|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lesykywozebyle.com (Spyware)"; content:"|0e|lesykywozebyle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup libynozegokido.com (Phishing_and_Theft)"; content:"|0e|libynozegokido|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lixumokyfo.com (Spyware)"; content:"|0a|lixumokyfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llantasdelpacifico.cl (Malware_Distribution)"; content:"|12|llantasdelpacifico|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lrvou.info (Malware_Distribution)"; content:"|05|lrvou|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxury-pride.ru (Malware_Distribution)"; content:"|0c|luxury-pride|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meb.gov.tr (Malware_Distribution)"; content:"|03|meb|03|gov|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mestferrit.co.cc (Malware_Infectors)"; content:"|0a|mestferrit|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milrphsrqtqpwtwr.org (Zeus_Zbot_SpyEye)"; content:"|10|milrphsrqtqpwtwr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moririnejuf.com (Phishing_and_Theft)"; content:"|0b|moririnejuf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movawypig.com (Spyware)"; content:"|09|movawypig|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mpnewsphoto.com (Malware_Distribution)"; content:"|0b|mpnewsphoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muhecuxudy.com (Spyware)"; content:"|0a|muhecuxudy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muzyzywupece.com (Spyware)"; content:"|0c|muzyzywupece|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup najelijywar.com (Spyware)"; content:"|0b|najelijywar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nakulpi.net (Malware_Distribution)"; content:"|07|nakulpi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nezutepazew.com (Spyware)"; content:"|0b|nezutepazew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitodocyri.com (Spyware)"; content:"|0a|nitodocyri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nsrnyosqqescloh.net (Malware_Infectors)"; content:"|0f|nsrnyosqqescloh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pifuxevunawewo.com (Spyware)"; content:"|0e|pifuxevunawewo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup posufejez.com (Phishing_and_Theft)"; content:"|09|posufejez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profi-softac.com (Fake_AV)"; content:"|0c|profi-softac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup progressive-avscan.com (Fake_AV)"; content:"|12|progressive-avscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-x.net (Malware_Distribution)"; content:"|09|protect-x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-for-you.net (Fake_AV)"; content:"|12|protection-for-you|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-foryou.com (Fake_AV)"; content:"|11|protection-foryou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-foryourt.net (Fake_AV)"; content:"|13|protection-foryourt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-foryousa.net (Fake_AV)"; content:"|13|protection-foryousa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-foryoute.net (Fake_AV)"; content:"|13|protection-foryoute|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-foryouti.com (Fake_AV)"; content:"|13|protection-foryouti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-foryouty.com (Fake_AV)"; content:"|13|protection-foryouty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionforyou.net (Fake_AV)"; content:"|10|protectionforyou|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puhigygapyhi.com (Phishing_and_Theft)"; content:"|0c|puhigygapyhi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup punemipaqatyc.com (Phishing_and_Theft)"; content:"|0d|punemipaqatyc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pydehenena.com (Malware_Infectors)"; content:"|0a|pydehenena|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qebinehuh.com (Phishing_and_Theft)"; content:"|09|qebinehuh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickscanprotectionsoft.com (Spyware)"; content:"|17|quickscanprotectionsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickscanprotectionxp.com (Spyware)"; content:"|15|quickscanprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickscansoftprotection.com (Spyware)"; content:"|17|quickscansoftprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickscansoftprotectionxp.com (Spyware)"; content:"|19|quickscansoftprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qyqinisope.com (Phishing_and_Theft)"; content:"|0a|qyqinisope|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine.com (Fake_AV)"; content:"|0d|r-superengine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine.net (Fake_AV)"; content:"|0d|r-superengine|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine1.com (Fake_AV)"; content:"|0e|r-superengine1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine1.net (Fake_AV)"; content:"|0e|r-superengine1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine2.com (Fake_AV)"; content:"|0e|r-superengine2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r8m.us (Malware_Infectors)"; content:"|03|r8m|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radiationprotectionantivscanxp.com (Spyware)"; content:"|1e|radiationprotectionantivscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup requireapriest.com (Malware_Distribution)"; content:"|0e|requireapriest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rorylexyzabihy.com (Spyware)"; content:"|0e|rorylexyzabihy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roskmvnsya.co.be (Phishing_and_Theft)"; content:"|0a|roskmvnsya|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrrpzrp.co.cc (Malware_Distribution)"; content:"|07|rrrpzrp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rubidanyxorun.com ()"; content:"|0d|rubidanyxorun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rvonrvw.com (Malware_Distribution)"; content:"|07|rvonrvw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rywoxekomecig.com (Spyware)"; content:"|0d|rywoxekomecig|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salyzubytedotu.com (Spyware)"; content:"|0e|salyzubytedotu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-again-antivirus.com (Fake_AV)"; content:"|14|scan-again-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-er-antivnoew.com (Spyware)"; content:"|11|scan-er-antivnoew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-eranti-vn-oew.com (Spyware)"; content:"|12|scan-eranti-vn-oew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-eranti-vnoew.com (Spyware)"; content:"|11|scan-eranti-vnoew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-erantivn-oew.com (Spyware)"; content:"|11|scan-erantivn-oew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-erantivnoew.com (Spyware)"; content:"|10|scan-erantivnoew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-protection-soft.com (Spyware)"; content:"|14|scan-protection-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanabsolutelyfreeantivxp.com (Spyware)"; content:"|19|scanabsolutelyfreeantivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanadamantivfree.com (Spyware)"; content:"|11|scanadamantivfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanerjaming.com (Fake_AV)"; content:"|0c|scanerjaming|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanerlboter.com (Fake_AV)"; content:"|0c|scanerlboter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanonline-desktop.net (Spyware)"; content:"|12|scanonline-desktop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scwiiraq.com (Malware_Distribution)"; content:"|08|scwiiraq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec-forguard1.com (Fake_AV)"; content:"|0d|sec-forguard1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-entired1.com (Fake_AV)"; content:"|0f|secure-entired1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-networks-solutions.com (Fake_AV)"; content:"|19|secure-networks-solutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureack.com (Fake_AV)"; content:"|09|secureack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureain.com (Fake_AV)"; content:"|09|secureain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seekerfeed.com (Malware_Distribution)"; content:"|0a|seekerfeed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seodp.info (Malware_Distribution)"; content:"|05|seodp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sesokiqufikeg.com (Phishing_and_Theft)"; content:"|0d|sesokiqufikeg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexypheromones.com (Malware_Distribution)"; content:"|0e|sexypheromones|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup singaporeuniquetravel.com (Malware_Distribution)"; content:"|15|singaporeuniquetravel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sisygynilulyh.com (Spyware)"; content:"|0d|sisygynilulyh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sosefekesylafy.com (Spyware)"; content:"|0e|sosefekesylafy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sozodikuqulec.com (Spyware)"; content:"|0d|sozodikuqulec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supecikasagynu.com (Spyware)"; content:"|0e|supecikasagynu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-security-guard.net (Fake_AV)"; content:"|12|top-security-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-stuff-guard.com (Fake_AV)"; content:"|0f|top-stuff-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-stuffmaster.net (Fake_AV)"; content:"|0f|top-stuffmaster|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-suite-foryou.com (Fake_AV)"; content:"|10|top-suite-foryou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tozibapah.com (Phishing_and_Theft)"; content:"|09|tozibapah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffik113.ru (Malware_Distribution)"; content:"|0a|traffik113|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsgz.info (Malware_Distribution)"; content:"|04|tsgz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twiitter.ru (Malware_Distribution)"; content:"|08|twiitter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup userdoptn.com (Malware_Distribution)"; content:"|09|userdoptn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup variantov.com (Phishing_and_Theft)"; content:"|09|variantov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vufekihoto.com (Phishing_and_Theft)"; content:"|0a|vufekihoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vupuhuzyniw.com (Spyware)"; content:"|0b|vupuhuzyniw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vwrwj6.com (Malware_Distribution)"; content:"|06|vwrwj6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vydevelorabik.com (Spyware)"; content:"|0d|vydevelorabik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vydidysur.com (Spyware)"; content:"|09|vydidysur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup walireqoxyxyt.com (Phishing_and_Theft)"; content:"|0d|walireqoxyxyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wepiminymu.com (Spyware)"; content:"|0a|wepiminymu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wizyvopyla.com (Phishing_and_Theft)"; content:"|0a|wizyvopyla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup womozedabati.com (Spyware)"; content:"|0c|womozedabati|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xezarecupohyv.com (Spyware)"; content:"|0d|xezarecupohyv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xomedefanace.com (Spyware)"; content:"|0c|xomedefanace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xumakyzolibuhy.com (Spyware)"; content:"|0e|xumakyzolibuhy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xygorinazecit.com (Phishing_and_Theft)"; content:"|0d|xygorinazecit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zavewuzykubo.com (Phishing_and_Theft)"; content:"|0c|zavewuzykubo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zidacofodafur.com (Phishing_and_Theft)"; content:"|0d|zidacofodafur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoo-mpeg.com (Malware_Distribution)"; content:"|08|zoo-mpeg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1websitedesign.net (Malware_Distribution)"; content:"|0e|1websitedesign|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dpsindirapuram.com (Malware_Distribution)"; content:"|0e|dpsindirapuram|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup japaneseupskirts.com (Malware_Distribution)"; content:"|10|japaneseupskirts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koilman.inodea.co.kr (Malware_Distribution)"; content:"|07|koilman|06|inodea|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lourensfourie.co.za (Malware_Distribution)"; content:"|0d|lourensfourie|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ojcow.home.pl (Malware_Distribution)"; content:"|05|ojcow|04|home|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup place4fun.nl (Malware_Distribution)"; content:"|09|place4fun|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ronaldneko.dothome.co.kr (Malware_Distribution)"; content:"|0a|ronaldneko|07|dothome|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-1signsinc.com (Malware_Distribution)"; content:"|0b|a-1signsinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nasze.net (Malware_Distribution)"; content:"|05|nasze|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqywf.com (Malware_Distribution)"; content:"|05|qqywf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ralocredit.es (Malware_Distribution)"; content:"|0a|ralocredit|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1st-consult.com (Fake_AV)"; content:"|0b|1st-consult|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaimac.com (Malware_Distribution)"; content:"|06|aaimac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adam-love.net (Malware_Infectors)"; content:"|09|adam-love|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aibbd.org (Malware_Distribution)"; content:"|05|aibbd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup air-komplex.hu (Malware_Distribution)"; content:"|0b|air-komplex|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alfortdkm73.awardspace.biz (Malware_Infectors)"; content:"|0b|alfortdkm73|0a|awardspace|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allergianap.hu (Malware_Distribution)"; content:"|0b|allergianap|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allow-strike.ru (Malware_Distribution)"; content:"|0c|allow-strike|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup andromari.cx.cc (Malware_Distribution)"; content:"|09|andromari|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avi7o.co.cc (Malware_Distribution)"; content:"|05|avi7o|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badcobro.net (Malware_Distribution)"; content:"|08|badcobro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ballisticcreations.com.au (Malware_Distribution)"; content:"|12|ballisticcreations|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banderlog.org (Malware_Distribution)"; content:"|09|banderlog|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbcosamavideo.mo.cx (Malware_Distribution)"; content:"|0d|bbcosamavideo|02|mo|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup behappiest.com (Malware_Distribution)"; content:"|0a|behappiest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biltermos.com (Malware_Distribution)"; content:"|09|biltermos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup campeche.gob.mx (Malware_Distribution)"; content:"|08|campeche|03|gob|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickbroken.org (Malware_Distribution)"; content:"|0b|clickbroken|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickclever.org (Malware_Infectors)"; content:"|0b|clickclever|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cryingfreemen.ru (Zeus_Zbot_SpyEye)"; content:"|0d|cryingfreemen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dansin.se (Malware_Distribution)"; content:"|06|dansin|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dodawa-appliances.com (Malware_Distribution)"; content:"|11|dodawa-appliances|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecoresearch.hu (Malware_Distribution)"; content:"|0b|ecoresearch|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elysianuae.com (Malware_Distribution)"; content:"|0a|elysianuae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ennisgourmet.com (Malware_Distribution)"; content:"|0c|ennisgourmet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extreme-channel.de (Malware_Distribution)"; content:"|0f|extreme-channel|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmlerulkesi.com (Malware_Distribution)"; content:"|0d|filmlerulkesi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findaddition.org (Malware_Infectors)"; content:"|0c|findaddition|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findadjustment.org (Malware_Infectors)"; content:"|0e|findadjustment|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findadvertisem.org (Malware_Distribution)"; content:"|0e|findadvertisem|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findinca.org (Malware_Infectors)"; content:"|08|findinca|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fogodeaquario.com.br (Malware_Distribution)"; content:"|0d|fogodeaquario|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fucktwice.in (Botnet_C&C)"; content:"|09|fucktwice|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ginevenessi.com (Zeus_Zbot_SpyEye)"; content:"|0b|ginevenessi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glickz.in (Botnet_C&C)"; content:"|06|glickz|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardvelpitumpc.com (Fake_AV)"; content:"|0f|guardvelpitumpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardvldbayerpc.net (Fake_AV)"; content:"|0f|guardvldbayerpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helptestsoft.com (Fake_AV)"; content:"|0c|helptestsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhoxaeiru1190ddk.net (Fake_AV)"; content:"|10|hhoxaeiru1190ddk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highclass-escort.ro (Malware_Distribution)"; content:"|10|highclass-escort|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highlvlguard.com (Fake_AV)"; content:"|0c|highlvlguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highlvlguard.net (Fake_AV)"; content:"|0c|highlvlguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highlvlguard1.com (Fake_AV)"; content:"|0d|highlvlguard1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highlvlguard1.net (Fake_AV)"; content:"|0d|highlvlguard1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highlvlguard2.com (Fake_AV)"; content:"|0d|highlvlguard2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoon2008.com (Malware_Distribution)"; content:"|08|hoon2008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hope-soft53.net (Fake_AV)"; content:"|0b|hope-soft53|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hope-soft54.com (Fake_AV)"; content:"|0b|hope-soft54|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hope-soft55.net (Fake_AV)"; content:"|0b|hope-soft55|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hope-soft56.com (Fake_AV)"; content:"|0b|hope-soft56|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hope-soft57.net (Fake_AV)"; content:"|0b|hope-soft57|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopsing-rot.com (Fake_AV)"; content:"|0b|hopsing-rot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopsing-rot.net (Fake_AV)"; content:"|0b|hopsing-rot|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopsingrot.com (Fake_AV)"; content:"|0a|hopsingrot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopsingrot.net (Fake_AV)"; content:"|0a|hopsingrot|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iaabo193.com (Malware_Distribution)"; content:"|08|iaabo193|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup it-friends.in.ua (Malware_Distribution)"; content:"|0a|it-friends|02|in|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jquery4html.co.cc (Malware_Distribution)"; content:"|0b|jquery4html|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup junioroops.name (Zeus_Zbot_SpyEye)"; content:"|0a|junioroops|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kerrq.com (Malware_Distribution)"; content:"|05|kerrq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kozusnictvomj.szm.com (Malware_Distribution)"; content:"|0d|kozusnictvomj|03|szm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krainaseriali.jun.pl (Malware_Distribution)"; content:"|0d|krainaseriali|03|jun|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kravinec.com (Malware_Distribution)"; content:"|08|kravinec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krunchit.net (Malware_Distribution)"; content:"|08|krunchit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup langameclan.com (Malware_Distribution)"; content:"|0b|langameclan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastyourmaster.com (Fake_AV)"; content:"|0e|lastyourmaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lessthenaseconddeal.com (Malware_Distribution)"; content:"|13|lessthenaseconddeal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main-defence.net (Fake_AV)"; content:"|0c|main-defence|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main-softguardsh.net (Fake_AV)"; content:"|10|main-softguardsh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main-softguardsk.net (Fake_AV)"; content:"|10|main-softguardsk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main-softguardsp.net (Fake_AV)"; content:"|10|main-softguardsp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main-softguardst.com (Fake_AV)"; content:"|10|main-softguardst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main-softguardti.com (Fake_AV)"; content:"|10|main-softguardti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup martpin.net (Zeus_Zbot_SpyEye)"; content:"|07|martpin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdsprojekt.com.pl (Malware_Distribution)"; content:"|0a|mdsprojekt|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mglz.oz.pl (Malware_Distribution)"; content:"|04|mglz|02|oz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro-chip.ru (Malware_Distribution)"; content:"|0a|micro-chip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milenachocolates.com.ar (Malware_Distribution)"; content:"|10|milenachocolates|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mktdesigns.com (Malware_Distribution)"; content:"|0a|mktdesigns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mortgageccloan.com (Malware_Distribution)"; content:"|0e|mortgageccloan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myinternetbusinessweblog.com (Malware_Distribution)"; content:"|18|myinternetbusinessweblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nauticalspecialties.com (Malware_Distribution)"; content:"|13|nauticalspecialties|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nazarethnursery.com (Malware_Distribution)"; content:"|0f|nazarethnursery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netfacil.th.im (Malware_Distribution)"; content:"|08|netfacil|02|th|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netupdate5.ru (Zeus_Zbot_SpyEye)"; content:"|0a|netupdate5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup never.by.ru (Malware_Distribution)"; content:"|05|never|02|by|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-wughire.com (Fake_AV)"; content:"|0b|new-wughire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notyfiwgt.co.cc (Malware_Distribution)"; content:"|09|notyfiwgt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oksoocwc.com (Malware_Distribution)"; content:"|08|oksoocwc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup open-soft-guardian.net (Fake_AV)"; content:"|12|open-soft-guardian|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup openlightsoft.com (Fake_AV)"; content:"|0d|openlightsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opentestoftin.com (Fake_AV)"; content:"|0d|opentestoftin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osamalivevideo.cc.im (Malware_Distribution)"; content:"|0e|osamalivevideo|02|cc|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overall-tool-of-secure.com (Fake_AV)"; content:"|16|overall-tool-of-secure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parfums.coolpage.biz (Malware_Distribution)"; content:"|07|parfums|08|coolpage|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-best-doctor1.com (Fake_AV)"; content:"|0f|pc-best-doctor1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-best-doctor2.com (Fake_AV)"; content:"|0f|pc-best-doctor2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-best-doctor3.com (Fake_AV)"; content:"|0f|pc-best-doctor3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-best-doctor4.com (Fake_AV)"; content:"|0f|pc-best-doctor4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-best-doctor5.com (Fake_AV)"; content:"|0f|pc-best-doctor5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfect-protection32.com (Fake_AV)"; content:"|14|perfect-protection32|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-antivir-holder.net (Fake_AV)"; content:"|17|personal-antivir-holder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-cleanholder.com (Fake_AV)"; content:"|14|personal-cleanholder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-networkguard.com (Fake_AV)"; content:"|15|personal-networkguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-scanholder.com (Fake_AV)"; content:"|13|personal-scanholder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-suite-guard.com (Fake_AV)"; content:"|14|personal-suite-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalnetwork-soft.com (Fake_AV)"; content:"|14|personalnetwork-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalnetworkmaster.com (Fake_AV)"; content:"|15|personalnetworkmaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalsecurity-4u.com (Fake_AV)"; content:"|13|personalsecurity-4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polecreekmeadows.com (Malware_Distribution)"; content:"|10|polecreekmeadows|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup posmi.net (Malware_Distribution)"; content:"|05|posmi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectwindowsxpvirusnow.com (Fake_AV)"; content:"|18|protectwindowsxpvirusnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectwinscanneralbum.com (Spyware)"; content:"|16|protectwinscanneralbum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectwinscannerdriver.com (Spyware)"; content:"|17|protectwinscannerdriver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectwinscannerdrivers.com (Spyware)"; content:"|18|protectwinscannerdrivers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectwinscannerinterface.com (Spyware)"; content:"|1a|protectwinscannerinterface|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectwinxpscan.com (Spyware)"; content:"|10|protectwinxpscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectwinxpscancomputers.com (Spyware)"; content:"|19|protectwinxpscancomputers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectwinxpscancorporation.com (Spyware)"; content:"|1b|protectwinxpscancorporation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectwinxpscandefinition.com (Spyware)"; content:"|1a|protectwinxpscandefinition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpbonescanvirus.com (Fake_AV)"; content:"|16|protectxpbonescanvirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpboundaryscanvirus.com (Fake_AV)"; content:"|1a|protectxpboundaryscanvirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpdriversvirusnow.com (Fake_AV)"; content:"|18|protectxpdriversvirusnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpliverscanvirus.com (Fake_AV)"; content:"|17|protectxpliverscanvirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxplungscanvirus.com (Fake_AV)"; content:"|16|protectxplungscanvirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpprogressivescanvirus.com (Fake_AV)"; content:"|1d|protectxpprogressivescanvirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpscanvirus.com (Fake_AV)"; content:"|12|protectxpscanvirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpscanvirusdefinitions.com (Fake_AV)"; content:"|1d|protectxpscanvirusdefinitions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpscanvirusdetected.com (Fake_AV)"; content:"|1a|protectxpscanvirusdetected|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpscanvirusdiseases.com (Fake_AV)"; content:"|1a|protectxpscanvirusdiseases|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxpscanvirusinfection.com (Fake_AV)"; content:"|1b|protectxpscanvirusinfection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectyourpcscan.com (Spyware)"; content:"|11|protectyourpcscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quevirusscano.com (Fake_AV)"; content:"|0d|quevirusscano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quevirusscanoxp.com (Fake_AV)"; content:"|0f|quevirusscanoxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine9.net (Fake_AV)"; content:"|0e|r-superengine9|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recatright.com (Fake_AV)"; content:"|0a|recatright|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recatright1.com (Fake_AV)"; content:"|0b|recatright1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recatright2.com (Fake_AV)"; content:"|0b|recatright2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recatright3.com (Fake_AV)"; content:"|0b|recatright3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recatright4.com (Fake_AV)"; content:"|0b|recatright4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup required-software.com (Fake_AV)"; content:"|11|required-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards.com (Fake_AV)"; content:"|0a|richguards|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards.net (Fake_AV)"; content:"|0a|richguards|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards1.com (Fake_AV)"; content:"|0b|richguards1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards1.net (Fake_AV)"; content:"|0b|richguards1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards10.net (Fake_AV)"; content:"|0c|richguards10|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards2.com (Fake_AV)"; content:"|0b|richguards2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards2.net (Fake_AV)"; content:"|0b|richguards2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards3.com (Fake_AV)"; content:"|0b|richguards3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards3.net (Fake_AV)"; content:"|0b|richguards3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards4.com (Fake_AV)"; content:"|0b|richguards4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards4.net (Fake_AV)"; content:"|0b|richguards4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards5.net (Fake_AV)"; content:"|0b|richguards5|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards6.com (Fake_AV)"; content:"|0b|richguards6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards7.net (Fake_AV)"; content:"|0b|richguards7|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sajko.co.cc (Malware_Distribution)"; content:"|05|sajko|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivwinfoin.com (Spyware)"; content:"|10|scanantivwinfoin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivwmodelsin.com (Spyware)"; content:"|12|scanantivwmodelsin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivwstorein.com (Spyware)"; content:"|11|scanantivwstorein|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivwtrucksin.com (Spyware)"; content:"|12|scanantivwtrucksin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanantivxp.com (Spyware)"; content:"|0b|scanantivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanaquilanerantv.com (Spyware)"; content:"|11|scanaquilanerantv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanbandieranerantv.com (Spyware)"; content:"|13|scanbandieranerantv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scancronacanerantv.com (Spyware)"; content:"|12|scancronacanerantv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scandanceagainantivirus.com (Fake_AV)"; content:"|17|scandanceagainantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectiondogswin.com (Spyware)"; content:"|18|scannerprotectiondogswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectiondogsxp.com (Spyware)"; content:"|17|scannerprotectiondogsxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionexpertsfree.com (Spyware)"; content:"|1c|scannerprotectionexpertsfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionexpertswin.com (Spyware)"; content:"|1b|scannerprotectionexpertswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionfactorfree.com (Spyware)"; content:"|1b|scannerprotectionfactorfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionfactorwin.com (Spyware)"; content:"|1a|scannerprotectionfactorwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionfast.com (Spyware)"; content:"|15|scannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionfilterfree.com (Spyware)"; content:"|1b|scannerprotectionfilterfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionfilterwin.com (Spyware)"; content:"|1a|scannerprotectionfilterwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionfree.com (Spyware)"; content:"|15|scannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionfunctionsfree.com (Spyware)"; content:"|1e|scannerprotectionfunctionsfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionfunctionswin.com (Spyware)"; content:"|1d|scannerprotectionfunctionswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionkansasfree.com (Spyware)"; content:"|1b|scannerprotectionkansasfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionkansaswin.com (Spyware)"; content:"|1a|scannerprotectionkansaswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionmeasurefree.com (Spyware)"; content:"|1c|scannerprotectionmeasurefree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionmethodsfree.com (Spyware)"; content:"|1c|scannerprotectionmethodsfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionspecialistxp.com (Spyware)"; content:"|1a|scanprotectionspecialistxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionsuitesoft.com (Spyware)"; content:"|17|scanprotectionsuitesoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionsuitexp.com (Spyware)"; content:"|15|scanprotectionsuitexp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionxp.com (Spyware)"; content:"|10|scanprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansoftdrinkprotection.com (Spyware)"; content:"|17|scansoftdrinkprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansoftdrinkprotectionxp.com (Spyware)"; content:"|19|scansoftdrinkprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansoftdrinksprotection.com (Spyware)"; content:"|18|scansoftdrinksprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansoftdrinksprotectionxp.com (Spyware)"; content:"|1a|scansoftdrinksprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansoftlandingprotectionxp.com (Spyware)"; content:"|1b|scansoftlandingprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansoftprotectionxp.com (Spyware)"; content:"|14|scansoftprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchallow.org (Malware_Infectors)"; content:"|0b|searchallow|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchbite.org (Fake_AV)"; content:"|0a|searchbite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchmodern.org (Malware_Distribution)"; content:"|0c|searchmodern|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server1.unibaq.com (Malware_Infectors)"; content:"|07|server1|06|unibaq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sirinflower.com (Malware_Distribution)"; content:"|0b|sirinflower|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soasnovas-radioplay.com (Malware_Distribution)"; content:"|13|soasnovas-radioplay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-cleaner.com (Spyware)"; content:"|0c|soft-cleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup srwsio_slupy.republika.pl (Malware_Distribution)"; content:"|0c|srwsio_slupy|09|republika|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stereo.si (Malware_Distribution)"; content:"|06|stereo|02|si"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tandriteerbe.info (Zeus_Zbot_SpyEye)"; content:"|0c|tandriteerbe|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testurl.ipq.co (Malware_Distribution)"; content:"|07|testurl|03|ipq|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantiviruzscanner.com (Fake_AV)"; content:"|13|theantiviruzscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantiviruzscannerxp.com (Fake_AV)"; content:"|15|theantiviruzscannerxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thedailynewsheadline.com (Malware_Distribution)"; content:"|14|thedailynewsheadline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trainingnewgeneration.net (Zeus_Zbot_SpyEye)"; content:"|15|trainingnewgeneration|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuk.kz (Zeus_Zbot_SpyEye)"; content:"|03|tuk|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tupostalesyfotos.com (Malware_Distribution)"; content:"|10|tupostalesyfotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubuntugid.ru (Malware_Infectors)"; content:"|09|ubuntugid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ufogomantisona.com (Zeus_Zbot_SpyEye)"; content:"|0e|ufogomantisona|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uvxmedia.info (Malware_Distribution)"; content:"|08|uvxmedia|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vastramworldwide.com (Malware_Distribution)"; content:"|10|vastramworldwide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veproxy.com (Malware_Distribution)"; content:"|07|veproxy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zbyasfgydjccxv.com (Zeus_Zbot_SpyEye)"; content:"|0e|zbyasfgydjccxv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bcdonline.de (Malware_Distribution)"; content:"|09|bcdonline|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enjoy-party.info (Malware_Distribution)"; content:"|0b|enjoy-party|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guadeloupe.cc (Malware_Infectors)"; content:"|0a|guadeloupe|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup health-standard.com (Malware_Distribution)"; content:"|0f|health-standard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lavasheskisehir.com (Malware_Distribution)"; content:"|0f|lavasheskisehir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mpcollection.webphoto.ir (Malware_Distribution)"; content:"|0c|mpcollection|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup time-sharing.de (Malware_Distribution)"; content:"|0c|time-sharing|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiix.info (Malware_Distribution)"; content:"|04|wiix|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlesyndioation.com (Malware_Distribution)"; content:"|11|googlesyndioation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strechykarafiat.cz (Malware_Distribution)"; content:"|0f|strechykarafiat|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 10-new-download.com (Malware_Distribution)"; content:"|0f|10-new-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 100-percent-free.com (Malware_Distribution)"; content:"|10|100-percent-free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 10pdf-new-download.com (Malware_Distribution)"; content:"|12|10pdf-new-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010--pdfreader.com (Malware_Distribution)"; content:"|0f|2010--pdfreader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-creator-download.com (Malware_Distribution)"; content:"|15|2010-creator-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-download.com (Malware_Distribution)"; content:"|0d|2010-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-latest-version.com (Malware_Distribution)"; content:"|13|2010-latest-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-new-version.com (Malware_Distribution)"; content:"|10|2010-new-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-new.com (Malware_Distribution)"; content:"|08|2010-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-pdf-pro.com (Malware_Distribution)"; content:"|0c|2010-pdf-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2011-download.com (Malware_Distribution)"; content:"|0d|2011-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2011-voip-new-download.ru (Malware_Distribution)"; content:"|16|2011-voip-new-download|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3-suite.org (Malware_Distribution)"; content:"|07|3-suite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3bxc.com (Malware_Distribution)"; content:"|04|3bxc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5-antivirus-shield.com (Fake_AV)"; content:"|12|5-antivirus-shield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5-startv.com (Malware_Distribution)"; content:"|08|5-startv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7-pro.com (Malware_Distribution)"; content:"|05|7-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9-burning-suite.com (Malware_Distribution)"; content:"|0f|9-burning-suite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9-new-version.com (Malware_Distribution)"; content:"|0d|9-new-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9981ly.com (Malware_Distribution)"; content:"|06|9981ly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9pdf-new-download.com (Malware_Distribution)"; content:"|11|9pdf-new-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9pdf-new.com (Malware_Distribution)"; content:"|08|9pdf-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9pdf-now.com (Malware_Distribution)"; content:"|08|9pdf-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9pdf-pro.com (Malware_Distribution)"; content:"|08|9pdf-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9pdfdownload-new.com (Malware_Distribution)"; content:"|10|9pdfdownload-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9pdfdownload.com (Malware_Distribution)"; content:"|0c|9pdfdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a4h9uploading.com (Malware_Distribution)"; content:"|0d|a4h9uploading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup absolute-searh.com (Spyware)"; content:"|0e|absolute-searh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acer9.com (Malware_Distribution)"; content:"|05|acer9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acrobat-software.com (Malware_Distribution)"; content:"|10|acrobat-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activeprocess.com (Malware_Distribution)"; content:"|0d|activeprocess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adaware-d0wnload.com (Malware_Distribution)"; content:"|10|adaware-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adaware-freescan.com (Malware_Distribution)"; content:"|10|adaware-freescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-10-download.com (Malware_Distribution)"; content:"|11|adobe-10-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advneeze.net (Malware_Distribution)"; content:"|08|advneeze|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup al-salamyiu.org (Malware_Distribution)"; content:"|0b|al-salamyiu|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ancytd.ru (Spyware)"; content:"|06|ancytd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus7reg.com (Fake_AV)"; content:"|0d|antivirus7reg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusdownload-now.com (Fake_AV)"; content:"|15|antivirusdownload-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusfreesee.com (Fake_AV)"; content:"|10|antivirusfreesee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspro-download.com (Fake_AV)"; content:"|15|antiviruspro-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirussafety.com (Fake_AV)"; content:"|0f|antivirussafety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviryssee.com (Fake_AV)"; content:"|0c|antiviryssee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appleipodpack.com (Malware_Distribution)"; content:"|0d|appleipodpack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appletunesdownload.com (Malware_Distribution)"; content:"|12|appletunesdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ares-ultradownloads.com (Malware_Distribution)"; content:"|13|ares-ultradownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avg-d0wnload.com (Malware_Distribution)"; content:"|0c|avg-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avscandefence.com (Malware_Distribution)"; content:"|0d|avscandefence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsnowwingroup.com (Spyware)"; content:"|0e|avsnowwingroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsscandefence.com (Malware_Distribution)"; content:"|0e|avsscandefence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsscandefenceinc.com (Malware_Distribution)"; content:"|11|avsscandefenceinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsscandefenceonline.com (Malware_Distribution)"; content:"|14|avsscandefenceonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-antivirusk0.com (Fake_AV)"; content:"|10|best-antivirusk0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestofnet.com.ua (Malware_Distribution)"; content:"|09|bestofnet|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigzalupen.ru (Spyware)"; content:"|0a|bigzalupen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blockbadsite.com (Malware_Distribution)"; content:"|0c|blockbadsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonaquadjriga.ru (Zeus_Zbot_SpyEye)"; content:"|0d|bonaquadjriga|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brexd.ru (Spyware)"; content:"|05|brexd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessopp0rtunities.com (Malware_Distribution)"; content:"|15|businessopp0rtunities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessoppirtunities.com (Malware_Distribution)"; content:"|15|businessoppirtunities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessoppoetunities.com (Malware_Distribution)"; content:"|15|businessoppoetunities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessopportunitiea.com (Malware_Distribution)"; content:"|15|businessopportunitiea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessopportunitiez.com (Malware_Distribution)"; content:"|15|businessopportunitiez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessoppprtunities.com (Malware_Distribution)"; content:"|15|businessoppprtunities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessppportunities.com (Malware_Distribution)"; content:"|15|businessppportunities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caserdddt.com (Spyware)"; content:"|09|caserdddt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cokk87.com (Malware_Distribution)"; content:"|06|cokk87|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combinationsacc.com (Malware_Distribution)"; content:"|0f|combinationsacc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compaq4.com (Malware_Distribution)"; content:"|07|compaq4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer4geeks.com (Malware_Distribution)"; content:"|0e|computer4geeks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coruwx.ru (Spyware)"; content:"|06|coruwx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosmeticdentistryvolusiacounty.com (Malware_Distribution)"; content:"|1e|cosmeticdentistryvolusiacounty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cruelstories.com (Malware_Distribution)"; content:"|0c|cruelstories|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cybersearch-0.com (Malware_Distribution)"; content:"|0d|cybersearch-0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decrd.ru (Spyware)"; content:"|05|decrd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-website-development.com (Malware_Distribution)"; content:"|15|e-website-development|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esiand.ru (Spyware)"; content:"|06|esiand|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup face-search.net (Spyware)"; content:"|0b|face-search|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fi1efre-11jo.com (Malware_Distribution)"; content:"|0c|fi1efre-11jo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filefre-llj0.com (Malware_Distribution)"; content:"|0c|filefre-llj0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funnys.webphoto.ir (Malware_Distribution)"; content:"|06|funnys|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glooer-searh.com (Spyware)"; content:"|0c|glooer-searh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grisco.go.ro (Malware_Distribution)"; content:"|06|grisco|02|go|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdfkslscanmaxw.co.cc (Malware_Distribution)"; content:"|0e|hdfkslscanmaxw|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdjfskh.net (Spyware)"; content:"|07|hdjfskh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homepc.it (Malware_Infectors)"; content:"|06|homepc|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostne.ru (Spyware)"; content:"|06|hostne|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idxxd.ru (Spyware)"; content:"|05|idxxd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iole.in (Spyware)"; content:"|04|iole|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetsetflysystems.asia (Zeus_Zbot_SpyEye)"; content:"|10|jetsetflysystems|04|asia"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jplclxivworikjm.net (Malware_Distribution)"; content:"|0f|jplclxivworikjm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karbjurator.co.cc (Malware_Distribution)"; content:"|0b|karbjurator|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livej0rny-shop.com (Malware_Distribution)"; content:"|0e|livej0rny-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livejorny-sh0p.com (Malware_Distribution)"; content:"|0e|livejorny-sh0p|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainsoftscanner40.com (Fake_AV)"; content:"|11|mainsoftscanner40|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainsoftscanner41.net (Fake_AV)"; content:"|11|mainsoftscanner41|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainsoftscanner42.com (Fake_AV)"; content:"|11|mainsoftscanner42|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainsoftscanner43.net (Fake_AV)"; content:"|11|mainsoftscanner43|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainsoftscanner44.com (Fake_AV)"; content:"|11|mainsoftscanner44|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mentld.ru (Spyware)"; content:"|06|mentld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mlmy.edu.pl (Malware_Distribution)"; content:"|04|mlmy|03|edu|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-free-protection28.com (Fake_AV)"; content:"|14|my-free-protection28|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-free-protection29.net (Fake_AV)"; content:"|14|my-free-protection29|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-free-protection30.com (Fake_AV)"; content:"|14|my-free-protection30|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-free-protection31.net (Fake_AV)"; content:"|14|my-free-protection31|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-personal-secure.net (Fake_AV)"; content:"|12|my-personal-secure|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-personalprotection.net (Fake_AV)"; content:"|15|my-personalprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mynrrljt.co.cc (Spyware)"; content:"|08|mynrrljt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n9-media.net (Malware_Distribution)"; content:"|08|n9-media|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup necessary-softav.net (Fake_AV)"; content:"|10|necessary-softav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nejucam.ro (Malware_Distribution)"; content:"|07|nejucam|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-softprotection.net (Fake_AV)"; content:"|12|net-softprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networktalingguard.com (Fake_AV)"; content:"|12|networktalingguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkthenatguard.net (Fake_AV)"; content:"|12|networkthenatguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkuzbaseguard.com (Fake_AV)"; content:"|12|networkuzbaseguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netzdvsecure.com (Fake_AV)"; content:"|0c|netzdvsecure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-bestav-soft.com (Fake_AV)"; content:"|0f|new-bestav-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-personalav.com (Fake_AV)"; content:"|0e|new-personalav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newblueshield.com (Fake_AV)"; content:"|0d|newblueshield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsavecry.com (Fake_AV)"; content:"|0a|newsavecry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsavedyss.com (Fake_AV)"; content:"|0b|newsavedyss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsaveent.com (Fake_AV)"; content:"|0a|newsaveent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsaveesed.com (Fake_AV)"; content:"|0b|newsaveesed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsavefily.com (Fake_AV)"; content:"|0b|newsavefily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niceamgot.com (Fake_AV)"; content:"|09|niceamgot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niceapgot.com (Fake_AV)"; content:"|09|niceapgot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicecegot.com (Fake_AV)"; content:"|09|nicecegot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niceeadgot.com (Fake_AV)"; content:"|0a|niceeadgot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niceeurn.com (Fake_AV)"; content:"|08|niceeurn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicefws.com (Fake_AV)"; content:"|07|nicefws|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicegasgot.com (Fake_AV)"; content:"|0a|nicegasgot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicehum.com (Fake_AV)"; content:"|07|nicehum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niceily.com (Fake_AV)"; content:"|07|niceily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niceinde.com (Fake_AV)"; content:"|08|niceinde|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niceing.com (Fake_AV)"; content:"|07|niceing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicemfa.com (Fake_AV)"; content:"|07|nicemfa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup no-regretforit.com (Fake_AV)"; content:"|0e|no-regretforit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup no-regretforit.net (Fake_AV)"; content:"|0e|no-regretforit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nobleaped.com (Fake_AV)"; content:"|09|nobleaped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nobleawke.com (Fake_AV)"; content:"|09|nobleawke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nobleaze.com (Fake_AV)"; content:"|08|nobleaze|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noregret-forit.com (Fake_AV)"; content:"|0e|noregret-forit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noregret-forit.net (Fake_AV)"; content:"|0e|noregret-forit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noregretfor-it.com (Fake_AV)"; content:"|0e|noregretfor-it|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noregretfor-it.net (Fake_AV)"; content:"|0e|noregretfor-it|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noregretforit.com (Fake_AV)"; content:"|0d|noregretforit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noregretforit.net (Fake_AV)"; content:"|0d|noregretforit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-shoppingworld.com (Fake_AV)"; content:"|14|online-shoppingworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup only-for-winners4u.net (Fake_AV)"; content:"|12|only-for-winners4u|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlypcprotection.net (Fake_AV)"; content:"|10|onlypcprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oppavp.ru (Spyware)"; content:"|06|oppavp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parishiltonporno1z.com (Spyware)"; content:"|12|parishiltonporno1z|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalsecurity-soft.com (Fake_AV)"; content:"|15|personalsecurity-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalsecuritychecker.net (Fake_AV)"; content:"|17|personalsecuritychecker|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalsecurityscanner.com (Fake_AV)"; content:"|17|personalsecurityscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalsuitesoft.com (Fake_AV)"; content:"|11|personalsuitesoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pixohawaii.net (Malware_Distribution)"; content:"|0a|pixohawaii|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavswininc.com (Malware_Distribution)"; content:"|0c|popavswininc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavswinxpinc.com (Malware_Distribution)"; content:"|0e|popavswinxpinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popularsofscan.com (Fake_AV)"; content:"|0e|popularsofscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup power-andsheildtool.net (Fake_AV)"; content:"|13|power-andsheildtool|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerfullsoft.com (Fake_AV)"; content:"|0d|powerfullsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puskovayaustanovka.ru (Spyware)"; content:"|12|puskovayaustanovka|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quake2012.ru (Malware_Distribution)"; content:"|09|quake2012|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine2.net (Fake_AV)"; content:"|0e|r-superengine2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine3.com (Fake_AV)"; content:"|0e|r-superengine3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine3.net (Fake_AV)"; content:"|0e|r-superengine3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine4.com (Fake_AV)"; content:"|0e|r-superengine4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine4.net (Fake_AV)"; content:"|0e|r-superengine4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine5.com (Fake_AV)"; content:"|0e|r-superengine5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine5.net (Fake_AV)"; content:"|0e|r-superengine5|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine6.com (Fake_AV)"; content:"|0e|r-superengine6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine6.net (Fake_AV)"; content:"|0e|r-superengine6|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine7.com (Fake_AV)"; content:"|0e|r-superengine7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine7.net (Fake_AV)"; content:"|0e|r-superengine7|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine8.com (Fake_AV)"; content:"|0e|r-superengine8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine8.net (Fake_AV)"; content:"|0e|r-superengine8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-superengine9.com (Fake_AV)"; content:"|0e|r-superengine9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards8.com (Fake_AV)"; content:"|0b|richguards8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richguards9.net (Fake_AV)"; content:"|0b|richguards9|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rightdirrecionsoft.com (Fake_AV)"; content:"|12|rightdirrecionsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riposteron.com (Fake_AV)"; content:"|0a|riposteron|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riposteron1.com (Fake_AV)"; content:"|0b|riposteron1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riposteron2.com (Fake_AV)"; content:"|0b|riposteron2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riposteron3.com (Fake_AV)"; content:"|0b|riposteron3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruphost.ru (Spyware)"; content:"|07|ruphost|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-clean4u.com (Fake_AV)"; content:"|0c|safe-clean4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-cleanholder.com (Fake_AV)"; content:"|10|safe-cleanholder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-keeper10.com (Fake_AV)"; content:"|0d|safe-keeper10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-keeper6.com (Fake_AV)"; content:"|0c|safe-keeper6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-keeper7.net (Fake_AV)"; content:"|0c|safe-keeper7|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-keeper8.com (Fake_AV)"; content:"|0c|safe-keeper8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-keeper9.net (Fake_AV)"; content:"|0c|safe-keeper9|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-networkholder.net (Fake_AV)"; content:"|12|safe-networkholder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-securityholder.com (Fake_AV)"; content:"|13|safe-securityholder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-securitysoft.net (Fake_AV)"; content:"|11|safe-securitysoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-zoneer.net (Fake_AV)"; content:"|0b|safe-zoneer|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-zoneks.net (Fake_AV)"; content:"|0b|safe-zoneks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-zonell.net (Fake_AV)"; content:"|0b|safe-zonell|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-zoneni.net (Fake_AV)"; content:"|0b|safe-zoneni|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-zonewi.com (Fake_AV)"; content:"|0b|safe-zonewi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeafor.com (Fake_AV)"; content:"|08|safeafor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeais.com (Fake_AV)"; content:"|07|safeais|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeazon.com (Fake_AV)"; content:"|08|safeazon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safebly.com (Fake_AV)"; content:"|07|safebly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safebrud.com (Fake_AV)"; content:"|08|safebrud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeclean-army.net (Fake_AV)"; content:"|0e|safeclean-army|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeclean-foru.net (Fake_AV)"; content:"|0e|safeclean-foru|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safecleanguard.com (Fake_AV)"; content:"|0e|safecleanguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safecps.com (Fake_AV)"; content:"|07|safecps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeein.com (Fake_AV)"; content:"|07|safeein|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scakpdupad.co.cc (Malware_Distribution)"; content:"|0a|scakpdupad|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchforbiz.net (Spyware)"; content:"|0c|searchforbiz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skype-download-n0w.com (Malware_Distribution)"; content:"|12|skype-download-n0w|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skype-s0ftware-d0wnload.com (Malware_Distribution)"; content:"|17|skype-s0ftware-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skype-v0ice-0ver-ip.com (Malware_Distribution)"; content:"|13|skype-v0ice-0ver-ip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skype-voice-over-ip.com (Malware_Distribution)"; content:"|13|skype-voice-over-ip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spybot-d0wnloads.com (Malware_Distribution)"; content:"|10|spybot-d0wnloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spybot-s0ftware.com (Malware_Distribution)"; content:"|0f|spybot-s0ftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thefrostwire.com (Malware_Distribution)"; content:"|0c|thefrostwire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelimewire.com (Malware_Distribution)"; content:"|0b|thelimewire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tlline0-cas.com (Malware_Distribution)"; content:"|0b|tlline0-cas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tm700.co.cc (Malware_Distribution)"; content:"|05|tm700|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turaminich.co.cc (Zeus_Zbot_SpyEye)"; content:"|0a|turaminich|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update-panasonicdrv-3dtv.com (Zeus_Zbot_SpyEye)"; content:"|18|update-panasonicdrv-3dtv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v22.cc (Fake_AV)"; content:"|03|v22|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v3erizonwireless.com (Malware_Distribution)"; content:"|10|v3erizonwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v4erizonwireless.com (Malware_Distribution)"; content:"|10|v4erizonwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ve3rizonwireless.com (Malware_Distribution)"; content:"|10|ve3rizonwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ve5rizonwireless.com (Malware_Distribution)"; content:"|10|ve5rizonwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ver8izonwireless.com (Malware_Distribution)"; content:"|10|ver8izonwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verijzonwireless.com (Malware_Distribution)"; content:"|10|verijzonwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veriz9onwireless.com (Malware_Distribution)"; content:"|10|veriz9onwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizo0nwireless.com (Malware_Distribution)"; content:"|10|verizo0nwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonw2ireless.com (Malware_Distribution)"; content:"|10|verizonw2ireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonwi5reless.com (Malware_Distribution)"; content:"|10|verizonwi5reless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonwi8reless.com (Malware_Distribution)"; content:"|10|verizonwi8reless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonwi9reless.com (Malware_Distribution)"; content:"|10|verizonwi9reless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonwir4eless.com (Malware_Distribution)"; content:"|10|verizonwir4eless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonwirel3ess.com (Malware_Distribution)"; content:"|10|verizonwirel3ess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonwirel4ess.com (Malware_Distribution)"; content:"|10|verizonwirel4ess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonwireldess.com (Malware_Distribution)"; content:"|10|verizonwireldess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonwirele4ss.com (Malware_Distribution)"; content:"|10|verizonwirele4ss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verizonwkireless.com (Malware_Distribution)"; content:"|10|verizonwkireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtual-dj-download.com (Malware_Distribution)"; content:"|13|virtual-dj-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voice-0ver-ip.com (Malware_Distribution)"; content:"|0d|voice-0ver-ip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vubwbtdgcrvnwcl.biz (Malware_Distribution)"; content:"|0f|vubwbtdgcrvnwcl|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuze-d0wnload.com (Malware_Distribution)"; content:"|0d|vuze-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winmx-downloads.com (Malware_Distribution)"; content:"|0f|winmx-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winrar-downloads.com (Malware_Distribution)"; content:"|10|winrar-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xywy.com (Malware_Distribution)"; content:"|04|xywy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyxy.net (Malware_Distribution)"; content:"|04|xyxy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zalupkin.ru (Spyware)"; content:"|08|zalupkin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoomt.net (Malware_Distribution)"; content:"|05|zoomt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artby-gorup.net (Phishing_and_Theft)"; content:"|0b|artby-gorup|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artby-group.biz (Phishing_and_Theft)"; content:"|0b|artby-group|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gazacham.ps (Malware_Distribution)"; content:"|08|gazacham|02|ps"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giustaofferta.com (Malware_Distribution)"; content:"|0d|giustaofferta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joaillerieliban.com (Malware_Distribution)"; content:"|0f|joaillerieliban|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kidspcprotect.com (Malware_Distribution)"; content:"|0d|kidspcprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup romtyreteam.ro (Malware_Distribution)"; content:"|0b|romtyreteam|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theshinhwa.com (Malware_Distribution)"; content:"|0a|theshinhwa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todayonmytv.com (Malware_Distribution)"; content:"|0b|todayonmytv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tree4you.org (Malware_Distribution)"; content:"|08|tree4you|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vodbd.org (Malware_Distribution)"; content:"|05|vodbd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alamstore.madpage.com (Malware_Distribution)"; content:"|09|alamstore|07|madpage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bismibrunei.com (Malware_Distribution)"; content:"|0b|bismibrunei|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demartegroup.com (Malware_Distribution)"; content:"|0c|demartegroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipcousa.com (Malware_Distribution)"; content:"|07|ipcousa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kvofbhusawal.com (Malware_Distribution)"; content:"|0c|kvofbhusawal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sudane4ever.com (Malware_Distribution)"; content:"|0b|sudane4ever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voneclick.com (Malware_Distribution)"; content:"|09|voneclick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1661666.com (Malware_Distribution)"; content:"|07|1661666|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 52cp.cn (Malware_Distribution)"; content:"|04|52cp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 55fafre.cx.cc (Malware_Distribution)"; content:"|07|55fafre|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5xse.com (Malware_Infectors)"; content:"|04|5xse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ake.kz (Malware_Distribution)"; content:"|03|ake|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alhana.hu (Malware_Distribution)"; content:"|06|alhana|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amginternational.com (Malware_Distribution)"; content:"|10|amginternational|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antisixrysscan.com (Malware_Distribution)"; content:"|0e|antisixrysscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-ryal.cx.cc (Fake_AV)"; content:"|0e|antivirus-ryal|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusan.com (Fake_AV)"; content:"|0b|antivirusan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirysscan.com (Fake_AV)"; content:"|0d|antivirysscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirysscanxp.com (Fake_AV)"; content:"|0f|antivirysscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirysseexp.com (Fake_AV)"; content:"|0e|antivirysseexp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup applebottommagazine.com (Malware_Distribution)"; content:"|13|applebottommagazine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ares-ultrapro.com (Malware_Distribution)"; content:"|0d|ares-ultrapro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aresultra.com (Malware_Distribution)"; content:"|09|aresultra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asgdfooooywgf.com (Malware_Distribution)"; content:"|0d|asgdfooooywgf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asphostserver.com (Malware_Distribution)"; content:"|0d|asphostserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup audio-editor-recorder.com (Malware_Distribution)"; content:"|15|audio-editor-recorder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avast-d0wnload.com (Malware_Distribution)"; content:"|0e|avast-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avast-downloads.com (Malware_Distribution)"; content:"|0f|avast-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup averaph.com (Malware_Distribution)"; content:"|07|averaph|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avg-2011-download.com (Malware_Distribution)"; content:"|11|avg-2011-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avg-downloads.com (Malware_Distribution)"; content:"|0d|avg-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avira-antivir-software.com (Fake_AV)"; content:"|16|avira-antivir-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avira-antivirus-scan.com (Fake_AV)"; content:"|14|avira-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avscolourcan.com (Spyware)"; content:"|0c|avscolourcan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsscandefencegroup.com (Malware_Distribution)"; content:"|13|avsscandefencegroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aware-download.com (Malware_Distribution)"; content:"|0e|aware-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ax-118.webphoto.ir (Malware_Distribution)"; content:"|06|ax-118|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aydeeegdweyfw.com (Malware_Distribution)"; content:"|0d|aydeeegdweyfw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badfquywefhwh.com (Malware_Distribution)"; content:"|0d|badfquywefhwh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banditcanyon.com (Malware_Distribution)"; content:"|0c|banditcanyon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bardpress.com (Malware_Distribution)"; content:"|09|bardpress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bashdgfyudgew.com (Malware_Distribution)"; content:"|0d|bashdgfyudgew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bavisoft.com (Malware_Distribution)"; content:"|08|bavisoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-antimalware.com (Fake_AV)"; content:"|10|best-antimalware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-chef-recipes.com (Malware_Distribution)"; content:"|11|best-chef-recipes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-skype-software.com (Malware_Distribution)"; content:"|13|best-skype-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestlimewire.com (Malware_Distribution)"; content:"|0c|bestlimewire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmovies-net.com (Malware_Distribution)"; content:"|0e|bestmovies-net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmp3-mix.com (Malware_Distribution)"; content:"|0b|bestmp3-mix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestorgblog.net (Malware_Distribution)"; content:"|0b|bestorgblog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bfivuzop.cn (Malware_Distribution)"; content:"|08|bfivuzop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bhorchhi.com (Malware_Distribution)"; content:"|08|bhorchhi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bimsha.biz (Malware_Distribution)"; content:"|06|bimsha|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizop3tester.com ()"; content:"|0c|bizop3tester|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bodybuilding-2010.com (Malware_Distribution)"; content:"|11|bodybuilding-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup book-download-center.com (Malware_Distribution)"; content:"|14|book-download-center|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookdownload-center.com (Malware_Distribution)"; content:"|13|bookdownload-center|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookholo.info (Malware_Distribution)"; content:"|08|bookholo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boolin.in (Malware_Distribution)"; content:"|06|boolin|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup browsernewdownload.com (Malware_Distribution)"; content:"|12|browsernewdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burn-2011.com (Malware_Distribution)"; content:"|09|burn-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burner-rom-9.com (Malware_Distribution)"; content:"|0c|burner-rom-9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burnerdownloads.com (Malware_Distribution)"; content:"|0f|burnerdownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burning-rom-new.com (Malware_Distribution)"; content:"|0f|burning-rom-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burning-rom10.com (Malware_Distribution)"; content:"|0d|burning-rom10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup business-flash.net ()"; content:"|0e|business-flash|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buy-all-wholesale.com (Malware_Distribution)"; content:"|11|buy-all-wholesale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bzefowum.cn (Malware_Distribution)"; content:"|08|bzefowum|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c4k-india.org (Malware_Distribution)"; content:"|09|c4k-india|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cajshcfytwgec.com (Malware_Distribution)"; content:"|0d|cajshcfytwgec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capnador.net (Malware_Distribution)"; content:"|08|capnador|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cardtransaction.com (Malware_Distribution)"; content:"|0f|cardtransaction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cathelyne.nl (Malware_Distribution)"; content:"|09|cathelyne|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdburner-d0wnload.com (Malware_Distribution)"; content:"|11|cdburner-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup client-2010.com (Malware_Distribution)"; content:"|0b|client-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cochinpropertymart.com (Malware_Distribution)"; content:"|12|cochinpropertymart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup complete-antivirusprotection.com (Fake_AV)"; content:"|1c|complete-antivirusprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup completeantivirusprotection.com (Fake_AV)"; content:"|1b|completeantivirusprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computerhorse.info (Malware_Distribution)"; content:"|0d|computerhorse|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contacts-navigator.com (Malware_Distribution)"; content:"|12|contacts-navigator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corporativo44.com (Malware_Distribution)"; content:"|0d|corporativo44|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counter2b.zapto.org (Malware_Distribution)"; content:"|09|counter2b|05|zapto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cqcb.com (Malware_Distribution)"; content:"|04|cqcb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creditholo.info (Malware_Distribution)"; content:"|0a|creditholo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup criminalupdates.com (Malware_Distribution)"; content:"|0f|criminalupdates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cukerbuker.com (Spyware)"; content:"|0a|cukerbuker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cureyeast-infection-now.com (Malware_Distribution)"; content:"|17|cureyeast-infection-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup current-download-online.com (Malware_Distribution)"; content:"|17|current-download-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cvvhost.com (Malware_Distribution)"; content:"|07|cvvhost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dashcfatfeygf.com (Malware_Distribution)"; content:"|0d|dashcfatfeygf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datingmatch-connection.com (Malware_Distribution)"; content:"|16|datingmatch-connection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datumer.com (Malware_Distribution)"; content:"|07|datumer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbabyshop.com (Malware_Distribution)"; content:"|09|dbabyshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddos-protection.cx.cc (Spyware)"; content:"|0f|ddos-protection|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delivery001.com (Malware_Infectors)"; content:"|0b|delivery001|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delivery002.com (Malware_Infectors)"; content:"|0b|delivery002|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delivery003.com (Malware_Infectors)"; content:"|0b|delivery003|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delivery004.com (Malware_Infectors)"; content:"|0b|delivery004|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup descargar-musica-2010.com (Malware_Distribution)"; content:"|15|descargar-musica-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup descargar-musica-2011.com (Malware_Distribution)"; content:"|15|descargar-musica-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup designerdiscountclub.com (Malware_Distribution)"; content:"|14|designerdiscountclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dftuhgsefwrger.com (Malware_Distribution)"; content:"|0e|dftuhgsefwrger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup douate.com (Malware_Distribution)"; content:"|06|douate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-antivirus-now.com (Fake_AV)"; content:"|16|download-antivirus-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-antivirus-pro.com (Fake_AV)"; content:"|16|download-antivirus-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-antivirus2010.com (Fake_AV)"; content:"|16|download-antivirus2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-istore.com (Malware_Distribution)"; content:"|0f|download-istore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-latest-skype.com (Malware_Distribution)"; content:"|15|download-latest-skype|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-musicpro.com (Malware_Distribution)"; content:"|11|download-musicpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-new-version.com (Malware_Distribution)"; content:"|14|download-new-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-new-voip-2010.com (Malware_Distribution)"; content:"|16|download-new-voip-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-official-version.com (Malware_Distribution)"; content:"|19|download-official-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-online.org (Malware_Distribution)"; content:"|0f|download-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-pdf-now.com (Malware_Distribution)"; content:"|10|download-pdf-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-pdf9.com (Malware_Distribution)"; content:"|0d|download-pdf9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-voip-2011.com (Malware_Distribution)"; content:"|12|download-voip-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadfor-all.com (Malware_Distribution)"; content:"|0f|downloadfor-all|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloading-new.com (Malware_Distribution)"; content:"|0f|downloading-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadmusicnew.com (Malware_Distribution)"; content:"|10|downloadmusicnew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drocuwil.cn (Malware_Distribution)"; content:"|08|drocuwil|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup durley-art-group.cc (Phishing_and_Theft)"; content:"|10|durley-art-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup durley-artau.net (Phishing_and_Theft)"; content:"|0c|durley-artau|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvd-shrink.us (Malware_Distribution)"; content:"|0a|dvd-shrink|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdshrink-download.com (Malware_Distribution)"; content:"|12|dvdshrink-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynamicdashboard.com (Malware_Distribution)"; content:"|10|dynamicdashboard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earth-2011.com (Malware_Distribution)"; content:"|0a|earth-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earth-download-2010.com (Malware_Distribution)"; content:"|13|earth-download-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earth-download-pro.com (Malware_Distribution)"; content:"|12|earth-download-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egyptvirysscan.com (Malware_Distribution)"; content:"|0e|egyptvirysscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup famous-poles.com (Malware_Distribution)"; content:"|0c|famous-poles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanclubmania.ru (Malware_Distribution)"; content:"|0c|fanclubmania|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fancytech.com (Malware_Distribution)"; content:"|09|fancytech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fatboyblog.com (Malware_Distribution)"; content:"|0a|fatboyblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fenkaololo2.com (Malware_Distribution)"; content:"|0b|fenkaololo2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fire1.de (Malware_Distribution)"; content:"|05|fire1|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freesexvip.com (Malware_Distribution)"; content:"|0a|freesexvip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuzzyyellowballs.com (Malware_Distribution)"; content:"|10|fuzzyyellowballs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gagaavswinxp.com (Malware_Distribution)"; content:"|0c|gagaavswinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groupknife.info (Malware_Distribution)"; content:"|0a|groupknife|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hbsfhwerbxn.co.cc (Malware_Distribution)"; content:"|0b|hbsfhwerbxn|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helby-group-ltd.cc (Phishing_and_Theft)"; content:"|0f|helby-group-ltd|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hockeysubnantais.free.fr (Malware_Distribution)"; content:"|10|hockeysubnantais|04|free|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horsecode.info (Malware_Distribution)"; content:"|09|horsecode|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horsegreen.info (Malware_Distribution)"; content:"|0a|horsegreen|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horsemoney.info (Malware_Distribution)"; content:"|0a|horsemoney|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horseyou.info (Malware_Distribution)"; content:"|08|horseyou|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hwyprowler.com (Malware_Distribution)"; content:"|0a|hwyprowler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup incubationcentre.ie (Malware_Distribution)"; content:"|10|incubationcentre|02|ie"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabbawockeez.us (Malware_Distribution)"; content:"|0c|jabbawockeez|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javaneiran.net (Malware_Distribution)"; content:"|0a|javaneiran|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jona-ardyn.com (Malware_Distribution)"; content:"|0a|jona-ardyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khdi.or.kr (Malware_Distribution)"; content:"|04|khdi|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koertig-gmbh.com (Phishing_and_Theft)"; content:"|0c|koertig-gmbh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kontech.kr (Malware_Distribution)"; content:"|07|kontech|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakerscanneravs.com (Spyware)"; content:"|0f|lakerscanneravs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkkhan.com (Malware_Distribution)"; content:"|08|linkkhan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup love-adambiz.net (Malware_Distribution)"; content:"|0c|love-adambiz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup love-adaminfo.net (Malware_Distribution)"; content:"|0d|love-adaminfo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup love-adamnet.net (Malware_Distribution)"; content:"|0c|love-adamnet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup love-adamorg.net (Malware_Distribution)"; content:"|0c|love-adamorg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lubawskie.yoyo.pl (Malware_Distribution)"; content:"|09|lubawskie|04|yoyo|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxurylollies.com (Malware_Distribution)"; content:"|0d|luxurylollies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m2625m.in (Malware_Distribution)"; content:"|06|m2625m|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mappy-shuttle.com (Malware_Distribution)"; content:"|0d|mappy-shuttle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mark-duncan.com (Malware_Distribution)"; content:"|0b|mark-duncan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup markizak.com (Malware_Distribution)"; content:"|08|markizak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masterpiece-group.cc (Phishing_and_Theft)"; content:"|11|masterpiece-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masterpiece-group.org (Phishing_and_Theft)"; content:"|11|masterpiece-group|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mayerpopavswinxp.com (Malware_Distribution)"; content:"|10|mayerpopavswinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mceheo.co.cc (Malware_Distribution)"; content:"|06|mceheo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mitissanservice-group-ltd.cc (Phishing_and_Theft)"; content:"|19|mitissanservice-group-ltd|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mitissanservicegroup-ltd.com (Phishing_and_Theft)"; content:"|18|mitissanservicegroup-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moghar.webphoto.ir (Malware_Distribution)"; content:"|06|moghar|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mvtygvmk.co.cc (Malware_Distribution)"; content:"|08|mvtygvmk|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantivirysscan.com (Fake_AV)"; content:"|0f|myantivirysscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypopavswin.com (Malware_Distribution)"; content:"|0b|mypopavswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypopavswinxp.com (Malware_Distribution)"; content:"|0d|mypopavswinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpopavswin.com (Malware_Distribution)"; content:"|0c|newpopavswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpopavswinxp.com (Malware_Distribution)"; content:"|0e|newpopavswinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsunky.com (Malware_Distribution)"; content:"|08|newsunky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noticiah.com (Malware_Distribution)"; content:"|08|noticiah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p-file.su (Malware_Distribution)"; content:"|06|p-file|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paulcompany.co.uk (Malware_Distribution)"; content:"|0b|paulcompany|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petburi.go.th (Malware_Distribution)"; content:"|07|petburi|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavsalbum.com (Malware_Distribution)"; content:"|0b|popavsalbum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavslose.com (Malware_Distribution)"; content:"|0a|popavslose|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavswin.com (Malware_Distribution)"; content:"|09|popavswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavswingroup.com (Malware_Distribution)"; content:"|0e|popavswingroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavswinxpgroup.com (Malware_Distribution)"; content:"|10|popavswinxpgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promisestoghana.com (Malware_Distribution)"; content:"|0f|promisestoghana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlive.co.kr (Malware_Distribution)"; content:"|05|qlive|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qyrzfhilst.ru (Malware_Distribution)"; content:"|0a|qyrzfhilst|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radiosol1230.net (Malware_Distribution)"; content:"|0c|radiosol1230|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalbuffetgrill.com (Malware_Distribution)"; content:"|10|royalbuffetgrill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeguardinscanner.com (Fake_AV)"; content:"|12|safeguardinscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeguardinsoft.com (Fake_AV)"; content:"|0f|safeguardinsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeinternetsoft.com (Fake_AV)"; content:"|10|safeinternetsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safemasteragatist.com (Fake_AV)"; content:"|11|safemasteragatist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safemasteramentive.com (Fake_AV)"; content:"|12|safemasteramentive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safemasteravoyelle.com (Fake_AV)"; content:"|12|safemasteravoyelle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safemasterbroothy.com (Fake_AV)"; content:"|11|safemasterbroothy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safemastercleagern.com (Fake_AV)"; content:"|12|safemastercleagern|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safemasteryellart.com (Fake_AV)"; content:"|11|safemasteryellart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeonly-guard.com (Fake_AV)"; content:"|0e|safeonly-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safesecurity-soft.net (Fake_AV)"; content:"|11|safesecurity-soft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safesecuritysoft.com (Fake_AV)"; content:"|10|safesecuritysoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safesuite-sentinel.com (Fake_AV)"; content:"|12|safesuite-sentinel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safesuite-soft.com (Fake_AV)"; content:"|0e|safesuite-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safezonec.com (Fake_AV)"; content:"|09|safezonec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safezonec.net (Fake_AV)"; content:"|09|safezonec|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safty-guard-avsoft.net (Fake_AV)"; content:"|12|safty-guard-avsoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safyour-pc-station.com (Fake_AV)"; content:"|12|safyour-pc-station|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup satbledifenceav.com (Fake_AV)"; content:"|0f|satbledifenceav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sauna.katowice.pl (Malware_Distribution)"; content:"|05|sauna|08|katowice|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-internetsoft.com (Fake_AV)"; content:"|11|save-internetsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-networkchecker.com (Fake_AV)"; content:"|13|save-networkchecker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-networkholder.net (Fake_AV)"; content:"|12|save-networkholder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-only4u.com (Fake_AV)"; content:"|0b|save-only4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-onlysentinel.com (Fake_AV)"; content:"|11|save-onlysentinel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanercrosyl.com (Fake_AV)"; content:"|0c|scanercrosyl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanergetsampy.com (Fake_AV)"; content:"|0e|scanergetsampy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanergister.com (Fake_AV)"; content:"|0c|scanergister|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionfactorsoft.com (Spyware)"; content:"|18|scanprotectionfactorsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionfactorxp.com (Spyware)"; content:"|16|scanprotectionfactorxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionfilterxp.com (Spyware)"; content:"|16|scanprotectionfilterxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionfunctionssoft.com (Spyware)"; content:"|1b|scanprotectionfunctionssoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionfunctionsxp.com (Spyware)"; content:"|19|scanprotectionfunctionsxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionkansasxp.com (Spyware)"; content:"|16|scanprotectionkansasxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionmeasuresoft.com (Spyware)"; content:"|19|scanprotectionmeasuresoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionmeasurexp.com (Spyware)"; content:"|17|scanprotectionmeasurexp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionmethodssoft.com (Spyware)"; content:"|19|scanprotectionmethodssoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionmethodsxp.com (Spyware)"; content:"|17|scanprotectionmethodsxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionofficessoft.com (Spyware)"; content:"|19|scanprotectionofficessoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionofficesxp.com (Spyware)"; content:"|17|scanprotectionofficesxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secretyoutube.com (Malware_Distribution)"; content:"|0d|secretyoutube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sktco.com (Malware_Distribution)"; content:"|05|sktco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snowshed.net (Malware_Distribution)"; content:"|08|snowshed|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup squit-group-llc.biz (Phishing_and_Theft)"; content:"|0f|squit-group-llc|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-zen.co.kr (Malware_Distribution)"; content:"|07|the-zen|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the1iwant.com (Malware_Distribution)"; content:"|09|the1iwant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thepopavswin.com (Malware_Distribution)"; content:"|0c|thepopavswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thewordofchristindia.com (Malware_Distribution)"; content:"|14|thewordofchristindia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-suite-holder.com (Fake_AV)"; content:"|10|top-suite-holder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-your-checker.com (Fake_AV)"; content:"|10|top-your-checker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-your-holder.net (Fake_AV)"; content:"|0f|top-your-holder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-your-keeper.net (Fake_AV)"; content:"|0f|top-your-keeper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toponly-checker.com (Fake_AV)"; content:"|0f|toponly-checker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toponly-checker.net (Fake_AV)"; content:"|0f|toponly-checker|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toppc-keeper.com (Fake_AV)"; content:"|0c|toppc-keeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toppcchecker.com (Fake_AV)"; content:"|0c|toppcchecker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toppcguard.net (Fake_AV)"; content:"|0a|toppcguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toppcholder.net (Fake_AV)"; content:"|0b|toppcholder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toppcmaster.com (Fake_AV)"; content:"|0b|toppcmaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topscanscanner.com (Fake_AV)"; content:"|0e|topscanscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsindia.biz (Malware_Distribution)"; content:"|07|tsindia|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttmusic.co.kr (Malware_Distribution)"; content:"|07|ttmusic|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turbokitstr.com (Malware_Distribution)"; content:"|0b|turbokitstr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turkish-hospitality.com (Malware_Distribution)"; content:"|13|turkish-hospitality|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatebackupserver.com (Malware_Distribution)"; content:"|12|updatebackupserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatebackupserver.kz (Malware_Distribution)"; content:"|12|updatebackupserver|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatebackupserver.ru (Malware_Distribution)"; content:"|12|updatebackupserver|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatebackupserver.su (Malware_Distribution)"; content:"|12|updatebackupserver|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsco.ru (Malware_Distribution)"; content:"|04|vsco|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watercolor-gallery.net (Malware_Distribution)"; content:"|12|watercolor-gallery|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webantivirysscanxp.com (Fake_AV)"; content:"|12|webantivirysscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiebeavswin.com (Malware_Distribution)"; content:"|0b|wiebeavswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpscanantiviren.com (Fake_AV)"; content:"|0f|xpscanantiviren|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xtrarobotz.com (Malware_Distribution)"; content:"|0a|xtrarobotz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z.azxr.net (Malware_Infectors)"; content:"|01|z|04|azxr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsritpowodowo.pl (Malware_Distribution)"; content:"|0d|zsritpowodowo|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blsmath.com (Malware_Distribution)"; content:"|07|blsmath|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bodegaspa.com (Malware_Distribution)"; content:"|09|bodegaspa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brainteaser-world.com (Malware_Distribution)"; content:"|11|brainteaser-world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monidopo.bee.pl (Malware_Distribution)"; content:"|08|monidopo|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radiosouf.free.fr (Malware_Distribution)"; content:"|09|radiosouf|04|free|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup renaudsw.com (Malware_Distribution)"; content:"|08|renaudsw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelemoncity.com (Malware_Distribution)"; content:"|0c|thelemoncity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alqara-group.net (Malware_Distribution)"; content:"|0c|alqara-group|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 131fafrfr.cx.cc (Malware_Distribution)"; content:"|09|131fafrfr|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 777inter.net (Malware_Distribution)"; content:"|08|777inter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-acrobat.us (Malware_Distribution)"; content:"|0d|adobe-acrobat|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adsfff.tk (Phishing_and_Theft)"; content:"|06|adsfff|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antisixrysscanxp.com (Malware_Distribution)"; content:"|10|antisixrysscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusfreescancentral.com (Fake_AV)"; content:"|18|antivirusfreescancentral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusfreescanonline.com (Fake_AV)"; content:"|17|antivirusfreescanonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusliberal.com (Fake_AV)"; content:"|10|antivirusliberal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusreleasescan.com (Fake_AV)"; content:"|14|antivirusreleasescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirysprotests.com (Fake_AV)"; content:"|11|antivirysprotests|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirysscanonline.com (Fake_AV)"; content:"|13|antivirysscanonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirysscanxponline.com (Fake_AV)"; content:"|15|antivirysscanxponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivscanct.com (Malware_Distribution)"; content:"|0b|antivscanct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqzkmfjw.gv.vg (Malware_Distribution)"; content:"|08|aqzkmfjw|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsexamineprotect.com (Malware_Distribution)"; content:"|11|avsexamineprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsnowtournament.com (Malware_Distribution)"; content:"|10|avsnowtournament|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsnowwin.com (Malware_Distribution)"; content:"|09|avsnowwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsnowwinonline.com (Malware_Distribution)"; content:"|0f|avsnowwinonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsscanattack.com (Malware_Distribution)"; content:"|0d|avsscanattack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup btfjackz.gv.vg (Malware_Distribution)"; content:"|08|btfjackz|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cidlsfqa.gv.vg (Malware_Distribution)"; content:"|08|cidlsfqa|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cjvcnnlp.gv.vg (Malware_Distribution)"; content:"|08|cjvcnnlp|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cldqkzwe.ce.ms (Malware_Distribution)"; content:"|08|cldqkzwe|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnxc.com (Malware_Distribution)"; content:"|04|cnxc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cordawield.cx.cc (Malware_Distribution)"; content:"|0a|cordawield|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coreruln.ce.ms (Malware_Distribution)"; content:"|08|coreruln|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhkmpdsu.co.cc (Malware_Distribution)"; content:"|08|dhkmpdsu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhoqoyal.cn (Malware_Distribution)"; content:"|08|dhoqoyal|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digicig.co.za (Malware_Distribution)"; content:"|07|digicig|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diorchid.com (Malware_Infectors)"; content:"|08|diorchid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diyasmw.cn (Malware_Distribution)"; content:"|07|diyasmw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-2010-version.com (Malware_Distribution)"; content:"|15|download-2010-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-access-now.com (Malware_Distribution)"; content:"|13|download-access-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easy-sellerguide.com (Malware_Distribution)"; content:"|10|easy-sellerguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easy-twitter-followers.com (Malware_Distribution)"; content:"|16|easy-twitter-followers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easyfrenchlesson.com (Malware_Distribution)"; content:"|10|easyfrenchlesson|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ehagcftygceyy.com (Malware_Distribution)"; content:"|0d|ehagcftygceyy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elitemovie-downloads.com (Malware_Distribution)"; content:"|14|elitemovie-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elitetv-downloads.com (Malware_Distribution)"; content:"|11|elitetv-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enscanantivirys.com (Fake_AV)"; content:"|0f|enscanantivirys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epad-media.com (Malware_Distribution)"; content:"|0a|epad-media|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epad-reader.com (Malware_Distribution)"; content:"|0b|epad-reader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evcolwcc.gv.vg (Malware_Distribution)"; content:"|08|evcolwcc|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eweyuyitjbvsdf.com (Malware_Distribution)"; content:"|0e|eweyuyitjbvsdf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exploit-pennyauctions.com (Malware_Distribution)"; content:"|15|exploit-pennyauctions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup falokmp.cn (Malware_Distribution)"; content:"|07|falokmp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup farmville-expert.com (Malware_Distribution)"; content:"|10|farmville-expert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-tvdownloads.com (Malware_Distribution)"; content:"|10|fast-tvdownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastmovie-downloads.com (Malware_Distribution)"; content:"|13|fastmovie-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscannerdefencecapabil.com (Malware_Distribution)"; content:"|19|fastscannerdefencecapabil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasttv-downloads.com (Malware_Distribution)"; content:"|10|fasttv-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdulbvmc.gv.vg (Malware_Distribution)"; content:"|08|fdulbvmc|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalenergy-incentives.com (Malware_Distribution)"; content:"|18|federalenergy-incentives|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalenergyincentives.com (Malware_Distribution)"; content:"|17|federalenergyincentives|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fhijafif.cn (Malware_Distribution)"; content:"|08|fhijafif|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fightingchannel-online.com (Malware_Distribution)"; content:"|16|fightingchannel-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup find-niche-guide.com (Malware_Distribution)"; content:"|10|find-niche-guide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup five-star-flix.com (Malware_Distribution)"; content:"|0e|five-star-flix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fixerror-404.com (Malware_Distribution)"; content:"|0c|fixerror-404|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frostwire-2011.com (Malware_Distribution)"; content:"|0e|frostwire-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frostwire-music.net (Malware_Distribution)"; content:"|0f|frostwire-music|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frostwire-s0ftware.com (Malware_Distribution)"; content:"|12|frostwire-s0ftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsfmetre.gv.vg (Malware_Distribution)"; content:"|08|gsfmetre|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hz88.com (Malware_Distribution)"; content:"|04|hz88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iduba.com (Malware_Distribution)"; content:"|05|iduba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilhikyou.gv.vg (Malware_Distribution)"; content:"|08|ilhikyou|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infobj.com (Malware_Distribution)"; content:"|06|infobj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inningsvsnowwin.com (Malware_Distribution)"; content:"|0f|inningsvsnowwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-173-201-152-5.ip.secureserver.net (Malware_Distribution)"; content:"|10|ip-173-201-152-5|02|ip|0c|secureserver|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irfanview-download.com (Malware_Distribution)"; content:"|12|irfanview-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itunes-d0wnload.com (Malware_Distribution)"; content:"|0f|itunes-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itunes-player-download.com (Malware_Distribution)"; content:"|16|itunes-player-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jioua82.cx.cc (Malware_Distribution)"; content:"|07|jioua82|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jljipxmu.gv.vg (Malware_Distribution)"; content:"|08|jljipxmu|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup komita-mentoring.com (Malware_Distribution)"; content:"|10|komita-mentoring|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kqdlcacl.ce.ms (Malware_Distribution)"; content:"|08|kqdlcacl|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lady11.com (Malware_Distribution)"; content:"|06|lady11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latest-2010-version.com (Malware_Distribution)"; content:"|13|latest-2010-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latest-new-download.com (Malware_Distribution)"; content:"|13|latest-new-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latest-new-pdf-download.com (Malware_Distribution)"; content:"|17|latest-new-pdf-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latest-online-version.com (Malware_Distribution)"; content:"|15|latest-online-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latest-skype-download.com (Malware_Distribution)"; content:"|15|latest-skype-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latestmobiledownloads.com (Malware_Distribution)"; content:"|15|latestmobiledownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lc-player-download.com (Malware_Distribution)"; content:"|12|lc-player-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lc-player.com (Malware_Distribution)"; content:"|09|lc-player|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lhamedep.cn (Malware_Distribution)"; content:"|08|lhamedep|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lime-wire-download.com (Malware_Distribution)"; content:"|12|lime-wire-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limewire-2011-download.com (Malware_Distribution)"; content:"|16|limewire-2011-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limewire-2011-now.com (Malware_Distribution)"; content:"|11|limewire-2011-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limewire-d0wnload-now.com (Malware_Distribution)"; content:"|15|limewire-d0wnload-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limewire-software.com (Malware_Distribution)"; content:"|11|limewire-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limewiremusic.org (Malware_Distribution)"; content:"|0d|limewiremusic|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limewiremusic2011.net (Malware_Distribution)"; content:"|11|limewiremusic2011|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limewiremusic2011.org (Malware_Distribution)"; content:"|11|limewiremusic2011|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limwire-p2p-download.com (Malware_Distribution)"; content:"|14|limwire-p2p-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-basketballchannel.com (Malware_Distribution)"; content:"|16|live-basketballchannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-boxing-channel.com (Malware_Distribution)"; content:"|13|live-boxing-channel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-boxingchannel.com (Malware_Distribution)"; content:"|12|live-boxingchannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-contact-support.com (Malware_Distribution)"; content:"|14|live-contact-support|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-cricket-online-access.com (Malware_Distribution)"; content:"|1a|live-cricket-online-access|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-cricketchannel.com (Malware_Distribution)"; content:"|13|live-cricketchannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-football-2010-online.com (Malware_Distribution)"; content:"|19|live-football-2010-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-footballchannel.com (Malware_Distribution)"; content:"|14|live-footballchannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-hockeychannel.com (Malware_Distribution)"; content:"|12|live-hockeychannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-lacrosse-channel.com (Malware_Distribution)"; content:"|15|live-lacrosse-channel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-online-football.tv (Malware_Distribution)"; content:"|14|live-online-football|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-online-now.tv (Malware_Distribution)"; content:"|0f|live-online-now|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-product-support.com (Malware_Distribution)"; content:"|14|live-product-support|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-rugbychannel.com (Malware_Distribution)"; content:"|11|live-rugbychannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-soccer-2010.com (Malware_Distribution)"; content:"|10|live-soccer-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-soccerchannel.com (Malware_Distribution)"; content:"|12|live-soccerchannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-sports-forpctv.com (Malware_Distribution)"; content:"|13|live-sports-forpctv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-support-ticket.com (Malware_Distribution)"; content:"|13|live-support-ticket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-watersportschannel.com (Malware_Distribution)"; content:"|17|live-watersportschannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-wrestlingchannel.com (Malware_Distribution)"; content:"|15|live-wrestlingchannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livebaseball-channel.com (Malware_Distribution)"; content:"|14|livebaseball-channel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livecyclingchannel.com (Malware_Distribution)"; content:"|12|livecyclingchannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livefootball-channel.com (Malware_Distribution)"; content:"|14|livefootball-channel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livegolf-channel.com (Malware_Distribution)"; content:"|10|livegolf-channel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lraroocn.gv.vg (Malware_Distribution)"; content:"|08|lraroocn|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarebytes-d0wnloads.com (Malware_Distribution)"; content:"|16|malwarebytes-d0wnloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarebytes-software.com (Malware_Distribution)"; content:"|15|malwarebytes-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mlfwvzcv.gv.vg (Malware_Distribution)"; content:"|08|mlfwvzcv|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3-music-d0wnloads.com (Malware_Distribution)"; content:"|13|mp3-music-d0wnloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantivirysscanxp.com (Fake_AV)"; content:"|11|myantivirysscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myxpscanantivirys.com (Fake_AV)"; content:"|11|myxpscanantivirys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nero-d0wnloads.com (Malware_Distribution)"; content:"|0e|nero-d0wnloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njpfsdey.co.cc (Malware_Distribution)"; content:"|08|njpfsdey|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyjianming.com (Malware_Distribution)"; content:"|0a|nyjianming|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup open-office-3.com (Malware_Distribution)"; content:"|0d|open-office-3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup openoffice-d0wnload.com (Malware_Distribution)"; content:"|13|openoffice-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup openoffice-s0ftware.com (Malware_Distribution)"; content:"|13|openoffice-s0ftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ousatcoyfu0t3.co.cc (Malware_Distribution)"; content:"|0d|ousatcoyfu0t3|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oxyboost.net (Malware_Distribution)"; content:"|08|oxyboost|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-10-download.com (Malware_Distribution)"; content:"|0f|pdf-10-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plsoapes.gv.vg (Malware_Distribution)"; content:"|08|plsoapes|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavswinonline.com (Malware_Distribution)"; content:"|0f|popavswinonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavswintournament.com (Malware_Distribution)"; content:"|13|popavswintournament|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavswinxp.com (Malware_Distribution)"; content:"|0b|popavswinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavswinxponline.com (Malware_Distribution)"; content:"|11|popavswinxponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavwin.com (Malware_Distribution)"; content:"|08|popavwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popavwinxp.com (Malware_Distribution)"; content:"|0a|popavwinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poweqtjd.gv.vg (Malware_Distribution)"; content:"|08|poweqtjd|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup programmall.com (Malware_Distribution)"; content:"|0b|programmall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puonjlmn.gv.vg (Malware_Distribution)"; content:"|08|puonjlmn|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quantummechanic.cc (Zeus_Zbot_SpyEye)"; content:"|0f|quantummechanic|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quicktime-player.net (Malware_Distribution)"; content:"|10|quicktime-player|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qxskbcoy.gv.vg (Malware_Distribution)"; content:"|08|qxskbcoy|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rbhpqdpf.gv.vg (Malware_Distribution)"; content:"|08|rbhpqdpf|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rpynhmpd.gv.vg (Malware_Distribution)"; content:"|08|rpynhmpd|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-power-guard.net (Fake_AV)"; content:"|10|save-power-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-security-foru.net (Fake_AV)"; content:"|12|save-security-foru|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-securitydefense.net (Fake_AV)"; content:"|14|save-securitydefense|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-suite-sentinel.com (Fake_AV)"; content:"|13|save-suite-sentinel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-suiteguard.com (Fake_AV)"; content:"|0f|save-suiteguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveonly-checker.net (Fake_AV)"; content:"|10|saveonly-checker|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveonly-scanner.com (Fake_AV)"; content:"|10|saveonly-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveonly4u.com (Fake_AV)"; content:"|0a|saveonly4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveornotsave.com (Fake_AV)"; content:"|0d|saveornotsave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveornotsave.net (Fake_AV)"; content:"|0d|saveornotsave|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveornotsave1.com (Fake_AV)"; content:"|0e|saveornotsave1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveornotsave1.net (Fake_AV)"; content:"|0e|saveornotsave1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savescansoft.com (Fake_AV)"; content:"|0c|savescansoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savesecurityguard.com (Fake_AV)"; content:"|11|savesecurityguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-protectionbest.com (Fake_AV)"; content:"|13|scan-protectionbest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanerafrago.com (Fake_AV)"; content:"|0c|scanerafrago|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup senatescanantivirys.com (Fake_AV)"; content:"|13|senatescanantivirys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shrm.com.au (Malware_Distribution)"; content:"|04|shrm|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skype-d0wnload.com (Malware_Distribution)"; content:"|0e|skype-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soundavswinxp.com (Malware_Distribution)"; content:"|0d|soundavswinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantivirysscanxp.com (Fake_AV)"; content:"|12|theantivirysscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thepopavswinxp.com (Malware_Distribution)"; content:"|0e|thepopavswinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thismustbesaved.in (Malware_Distribution)"; content:"|0f|thismustbesaved|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thobandis.cx.cc (Malware_Distribution)"; content:"|09|thobandis|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tobmarket.com (Malware_Distribution)"; content:"|09|tobmarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tournamentavswin.com (Malware_Distribution)"; content:"|10|tournamentavswin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhemeehj.co.cc (Malware_Distribution)"; content:"|08|xhemeehj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--brv05ylox.com (Malware_Distribution)"; content:"|0d|xn--brv05ylox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--hvs035e.com (Malware_Distribution)"; content:"|0b|xn--hvs035e|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--kbr59t53njlfwvj.com (Malware_Distribution)"; content:"|13|xn--kbr59t53njlfwvj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--nqv968a7ur.com (Malware_Distribution)"; content:"|0e|xn--nqv968a7ur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--nqvp8a.com (Malware_Distribution)"; content:"|0a|xn--nqvp8a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--omsq06a.com (Malware_Distribution)"; content:"|0b|xn--omsq06a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--rssu71d4ti.com (Malware_Distribution)"; content:"|0e|xn--rssu71d4ti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--xfr829bcne.com (Malware_Distribution)"; content:"|0e|xn--xfr829bcne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ydcmblin.gv.vg (Malware_Distribution)"; content:"|08|ydcmblin|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yurzdtas.gv.vg (Malware_Distribution)"; content:"|08|yurzdtas|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yybtv.com (Malware_Distribution)"; content:"|05|yybtv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zm2008.com (Malware_Distribution)"; content:"|06|zm2008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsbaby.com (Malware_Distribution)"; content:"|06|zsbaby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsbook.com (Malware_Distribution)"; content:"|06|zsbook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsgr.com (Malware_Distribution)"; content:"|04|zsgr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsjt.com (Malware_Distribution)"; content:"|04|zsjt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khorasannews.ir (Malware_Distribution)"; content:"|0c|khorasannews|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chandelarts.com (Malware_Distribution)"; content:"|0b|chandelarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chicagolandconstruction.com (Malware_Distribution)"; content:"|17|chicagolandconstruction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgp.cc (Malware_Distribution)"; content:"|03|dgp|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nakulan.co.in (Malware_Distribution)"; content:"|07|nakulan|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup surian.co.kr (Malware_Distribution)"; content:"|06|surian|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usimmigrationconsulting.com (Malware_Distribution)"; content:"|17|usimmigrationconsulting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uspl8s.de (Malware_Distribution)"; content:"|06|uspl8s|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamarer.com (Malware_Distribution)"; content:"|07|tamarer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buyukavsar.de (Malware_Distribution)"; content:"|0a|buyukavsar|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elsabrosito.com (Malware_Distribution)"; content:"|0b|elsabrosito|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myblindstudioinfoonline.com (Malware_Distribution)"; content:"|17|myblindstudioinfoonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1blacklist.com (Botnet_C&C)"; content:"|0a|1blacklist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accsupdate.com (Botnet_C&C)"; content:"|0a|accsupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activation-tools.com (Botnet_C&C)"; content:"|10|activation-tools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aimicgroup-llc.co (Phishing_and_Theft)"; content:"|0e|aimicgroup-llc|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alertsforsafe.com (Spyware)"; content:"|0d|alertsforsafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allbhistory.ru (Spyware)"; content:"|0b|allbhistory|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anotherdnserrorz.com ()"; content:"|10|anotherdnserrorz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anpopo.com (Malware_Distribution)"; content:"|06|anpopo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antidepressantsonline.org (Botnet_C&C)"; content:"|15|antidepressantsonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av7software.com (Botnet_C&C)"; content:"|0b|av7software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bebozasuk.com (Spyware)"; content:"|09|bebozasuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestcolourscanantiv.com (Spyware)"; content:"|13|bestcolourscanantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev1news.com ()"; content:"|0b|bizdev1news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev20news.com ()"; content:"|0c|bizdev20news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev2news.com ()"; content:"|0b|bizdev2news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev3news.com ()"; content:"|0b|bizdev3news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev4news.com ()"; content:"|0b|bizdev4news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev5news.com ()"; content:"|0b|bizdev5news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev6news.com ()"; content:"|0b|bizdev6news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev7news.com ()"; content:"|0b|bizdev7news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev8news.com ()"; content:"|0b|bizdev8news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev9news.com ()"; content:"|0b|bizdev9news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup busipokumobij.com (Spyware)"; content:"|0d|busipokumobij|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carysoqylalewe.com (Spyware)"; content:"|0e|carysoqylalewe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clubdrunk.com (Malware_Distribution)"; content:"|09|clubdrunk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cowyqicavisyl.com (Spyware)"; content:"|0d|cowyqicavisyl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cv-distribution.com (Botnet_C&C)"; content:"|0f|cv-distribution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cytisenuworyr.com (Spyware)"; content:"|0d|cytisenuworyr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dajacejobiqen.com (Spyware)"; content:"|0d|dajacejobiqen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datahelpercorp.com (Malware_Distribution)"; content:"|0e|datahelpercorp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup debecyzedap.com (Spyware)"; content:"|0b|debecyzedap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-qwfrc.in (Malware_Infectors)"; content:"|0e|defender-qwfrc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derwoode-group.cc (SEO_Fraud)"; content:"|0e|derwoode-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deshevshe.net.ua (Malware_Distribution)"; content:"|09|deshevshe|03|net|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digital-stream-movie.com (Malware_Distribution)"; content:"|14|digital-stream-movie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digital-stream-video.com (Malware_Distribution)"; content:"|14|digital-stream-video|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalstreamvideo.net (Malware_Distribution)"; content:"|12|digitalstreamvideo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalstreamvideoarea.net (Malware_Distribution)"; content:"|16|digitalstreamvideoarea|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalvideoportal.net (Malware_Distribution)"; content:"|12|digitalvideoportal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolcevita-cash.com (Botnet_C&C)"; content:"|0e|dolcevita-cash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolcevita-cash.net (Botnet_C&C)"; content:"|0e|dolcevita-cash|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadingtheworld.com (Botnet_C&C)"; content:"|13|downloadingtheworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earth-locations-online-download.com (Malware_Distribution)"; content:"|1f|earth-locations-online-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earth-locations-online.com (Malware_Distribution)"; content:"|16|earth-locations-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earth-map-2011.com (Malware_Distribution)"; content:"|0e|earth-map-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earth-online-locations.com (Malware_Distribution)"; content:"|16|earth-online-locations|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earth-telechargement.com (Malware_Distribution)"; content:"|14|earth-telechargement|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earthdownload-new.com (Malware_Distribution)"; content:"|11|earthdownload-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earthmapcontacts.com (Malware_Distribution)"; content:"|10|earthmapcontacts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eastern-art-group-ltd.com (Phishing_and_Theft)"; content:"|15|eastern-art-group-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eroticalgirl.ru (Malware_Distribution)"; content:"|0c|eroticalgirl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup event.webserviceskot.ru (Botnet_C&C)"; content:"|05|event|0e|webserviceskot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscannerdefencecooperation.com (Spyware)"; content:"|1d|fastscannerdefencecooperation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscannerdefencedivision.com (Spyware)"; content:"|1a|fastscannerdefencedivision|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscannerdefenceexpenditure.com (Spyware)"; content:"|1d|fastscannerdefenceexpenditure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findbigboob.cn (Malware_Distribution)"; content:"|0b|findbigboob|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flyercenter.com (Malware_Distribution)"; content:"|0b|flyercenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foresttest218999fhjslk.com.tw (Zeus_Zbot_SpyEye)"; content:"|16|foresttest218999fhjslk|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-internet-movie.com (Malware_Distribution)"; content:"|13|free-internet-movie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-movie-stream-video.com (Malware_Distribution)"; content:"|17|free-movie-stream-video|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-stream-video.com (Malware_Distribution)"; content:"|11|free-stream-video|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freedigitalstreamvideo.com (Malware_Distribution)"; content:"|16|freedigitalstreamvideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freevidsdump.com (Botnet_C&C)"; content:"|0c|freevidsdump|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fymumiviku.com (Spyware)"; content:"|0a|fymumiviku|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geferio.net (Botnet_C&C)"; content:"|07|geferio|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geheyo9.co.cc (Malware_Distribution)"; content:"|07|geheyo9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glacis-groupllc.com (SEO_Fraud)"; content:"|0f|glacis-groupllc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glacis-groupuk.net (SEO_Fraud)"; content:"|0e|glacis-groupuk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glacisgroup-llc.net (SEO_Fraud)"; content:"|0f|glacisgroup-llc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gleichfalls-group.cc (Phishing_and_Theft)"; content:"|11|gleichfalls-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goup435brd3.com (Malware_Distribution)"; content:"|0b|goup435brd3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gstatig.com (Malware_Distribution)"; content:"|07|gstatig|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guxirysynyges.com (Spyware)"; content:"|0d|guxirysynyges|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hevahubaketa.com (Spyware)"; content:"|0c|hevahubaketa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hydajerenagy.com (Malware_Infectors)"; content:"|0c|hydajerenagy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyvinusys.com (Spyware)"; content:"|09|hyvinusys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibm-pad.com (Botnet_C&C)"; content:"|07|ibm-pad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibminfrastructure.com (Botnet_C&C)"; content:"|11|ibminfrastructure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibmvendor.com (Botnet_C&C)"; content:"|09|ibmvendor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imdbvideo.ru (Spyware)"; content:"|09|imdbvideo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetmovieportal.net (Malware_Distribution)"; content:"|13|internetmovieportal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetmoviestream.com (Malware_Distribution)"; content:"|13|internetmoviestream|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup josigyhyt.com (Malware_Infectors)"; content:"|09|josigyhyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jowohipyfuw.com (Spyware)"; content:"|0b|jowohipyfuw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jupuqeqej.com (Malware_Infectors)"; content:"|09|jupuqeqej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jusywiruseqoda.com (Spyware)"; content:"|0e|jusywiruseqoda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kade-groupde.net (SEO_Fraud)"; content:"|0c|kade-groupde|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiguqejonodul.com (Spyware)"; content:"|0d|kiguqejonodul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kirovulot.com (Spyware)"; content:"|09|kirovulot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kovyrecanyvi.com (Spyware)"; content:"|0c|kovyrecanyvi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kyxagojibiwude.com (Spyware)"; content:"|0e|kyxagojibiwude|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lagisipiweso.com (Malware_Infectors)"; content:"|0c|lagisipiweso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lajusinajoz.com (Malware_Infectors)"; content:"|0b|lajusinajoz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lavifopihune.com (Spyware)"; content:"|0c|lavifopihune|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lbm-groupinc.com (Phishing_and_Theft)"; content:"|0c|lbm-groupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lemotukes.com (SEO_Fraud)"; content:"|09|lemotukes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup licensetools.com (Botnet_C&C)"; content:"|0c|licensetools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lionking3d.com (Botnet_C&C)"; content:"|0a|lionking3d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup losidamud.com (Malware_Infectors)"; content:"|09|losidamud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzjl.com (Malware_Distribution)"; content:"|04|lzjl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medswithoutbads.com (Botnet_C&C)"; content:"|0f|medswithoutbads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaspywareblock.com (Botnet_C&C)"; content:"|10|megaspywareblock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup menzel-group.tv (Phishing_and_Theft)"; content:"|0c|menzel-group|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meqijuxosomov.com (Malware_Infectors)"; content:"|0d|meqijuxosomov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myhemilymucy.com (Malware_Infectors)"; content:"|0c|myhemilymucy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myroitracking.com (Malware_Distribution)"; content:"|0d|myroitracking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywitojojitug.com (Spyware)"; content:"|0d|mywitojojitug|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myznakomstvo.com (Botnet_C&C)"; content:"|0c|myznakomstvo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networki10.com (Botnet_C&C)"; content:"|0a|networki10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup norupawetud.com (Spyware)"; content:"|0b|norupawetud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nosesusucuqiro.com (SEO_Fraud)"; content:"|0e|nosesusucuqiro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nslookupxo.com (Malware_Infectors)"; content:"|0a|nslookupxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuremazyny.com (Malware_Infectors)"; content:"|0a|nuremazyny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-check-v0.com (Botnet_C&C)"; content:"|0f|online-check-v0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-check-v11.com (Botnet_C&C)"; content:"|10|online-check-v11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-check-v7.com (Botnet_C&C)"; content:"|0f|online-check-v7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-check-v9.com (Botnet_C&C)"; content:"|0f|online-check-v9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-stream-videos.net (Malware_Distribution)"; content:"|14|online-stream-videos|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinedigitalstreamvideo.net (Malware_Distribution)"; content:"|18|onlinedigitalstreamvideo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemovieshow.net (Malware_Distribution)"; content:"|0f|onlinemovieshow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemoviesstreamvideo.com (Malware_Distribution)"; content:"|17|onlinemoviesstreamvideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paypopup.com (Malware_Distribution)"; content:"|08|paypopup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2600668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcpop.com (Malware_Distribution)"; content:"|05|pcpop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdsoftsupport.com (Botnet_C&C)"; content:"|0d|pdsoftsupport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pigymemukux.com (Spyware)"; content:"|0b|pigymemukux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pimerypomike.com (Spyware)"; content:"|0c|pimerypomike|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plateau.pl (Malware_Distribution)"; content:"|07|plateau|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popoks.ru (Malware_Distribution)"; content:"|06|popoks|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popupbegone.com (Spyware)"; content:"|0b|popupbegone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prestotuneup.com (Botnet_C&C)"; content:"|0c|prestotuneup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup primescan1.com (Botnet_C&C)"; content:"|0a|primescan1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pywocajypice.com (Spyware)"; content:"|0c|pywocajypice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qamezeqyce.com (SEO_Fraud)"; content:"|0a|qamezeqyce|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickfree-movie.com (Malware_Distribution)"; content:"|0f|quickfree-movie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qumomulyr.com (Malware_Infectors)"; content:"|09|qumomulyr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup racing-channel.net (Malware_Distribution)"; content:"|0e|racing-channel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup racing-channels.com (Malware_Distribution)"; content:"|0f|racing-channels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radiationexpert.org (Malware_Distribution)"; content:"|0f|radiationexpert|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reader-2010-download.com (Malware_Distribution)"; content:"|14|reader-2010-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recession-guide-pro.com (Malware_Distribution)"; content:"|13|recession-guide-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regclean-2010.com (Malware_Distribution)"; content:"|0d|regclean-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relyfehazoz.com (Spyware)"; content:"|0b|relyfehazoz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rerumejid.com (Spyware)"; content:"|09|rerumejid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjilegiv.cn (Malware_Distribution)"; content:"|08|rjilegiv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rydoryxowokic.com (SEO_Fraud)"; content:"|0d|rydoryxowokic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safegateway-id.com (Malware_Distribution)"; content:"|0e|safegateway-id|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sagizunilyqos.com (Spyware)"; content:"|0d|sagizunilyqos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sapypokupyhaky.com (SEO_Fraud)"; content:"|0e|sapypokupyhaky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantimalware0.com (Fake_AV)"; content:"|13|scannerantimalware0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantimalware2.com (Fake_AV)"; content:"|13|scannerantimalware2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantimalware4.com (Fake_AV)"; content:"|13|scannerantimalware4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantimalware6.com (Fake_AV)"; content:"|13|scannerantimalware6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdifasip.cn (Malware_Distribution)"; content:"|08|sdifasip|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-destroy-protect.com (Malware_Distribution)"; content:"|16|search-destroy-protect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-destroy-protection.com (Malware_Distribution)"; content:"|19|search-destroy-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-destroy-scan.com (Malware_Distribution)"; content:"|13|search-destroy-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-destroy.com (Malware_Distribution)"; content:"|0e|search-destroy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchdestroy-download.com (Malware_Distribution)"; content:"|16|searchdestroy-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchdestroy-scan.com (Malware_Distribution)"; content:"|12|searchdestroy-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.ovicompstore.com (Botnet_C&C)"; content:"|06|secure|0c|ovicompstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.ovisoftstore.com (Botnet_C&C)"; content:"|06|secure|0c|ovisoftstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securepay-processor.com (Botnet_C&C)"; content:"|13|securepay-processor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup singul.co.cc (Malware_Infectors)"; content:"|06|singul|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softsales-discount.com (Botnet_C&C)"; content:"|12|softsales-discount|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-wens.co.cc (Malware_Infectors)"; content:"|0d|software-wens|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sortiedusine.com (Malware_Distribution)"; content:"|0c|sortiedusine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spampill.net (Botnet_C&C)"; content:"|08|spampill|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup special-artuk.com (SEO_Fraud)"; content:"|0d|special-artuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup speed-tube.net (Malware_Distribution)"; content:"|0a|speed-tube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywarebegone.com (Spyware)"; content:"|0d|spywarebegone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywarevanisher.com (Spyware)"; content:"|0f|spywarevanisher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starc4.com (Botnet_C&C)"; content:"|06|starc4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stfuthesims.ru (Zeus_Zbot_SpyEye)"; content:"|0b|stfuthesims|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stream-video-portal.com (Malware_Distribution)"; content:"|13|stream-video-portal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamletmovies.com (Malware_Distribution)"; content:"|0f|streamletmovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamvideoportal.net (Malware_Distribution)"; content:"|11|streamvideoportal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stretci.com (Botnet_C&C)"; content:"|07|stretci|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup styleway.ru (Malware_Distribution)"; content:"|08|styleway|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysdllupdates.com (Botnet_C&C)"; content:"|0d|sysdllupdates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syssem.com (Malware_Infectors)"; content:"|06|syssem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systempromns.com (Botnet_C&C)"; content:"|0c|systempromns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup takywegywejesy.com (SEO_Fraud)"; content:"|0e|takywegywejesy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terminator2012.com (Botnet_C&C)"; content:"|0e|terminator2012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testfortestltd444557.com.tw (Zeus_Zbot_SpyEye)"; content:"|14|testfortestltd444557|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testing1testing2fhj3888222.com.tw (Zeus_Zbot_SpyEye)"; content:"|1a|testing1testing2fhj3888222|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testingforinnovation2221999.com.tw (Zeus_Zbot_SpyEye)"; content:"|1b|testingforinnovation2221999|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testtestingpotatoes111222.com.tw (Zeus_Zbot_SpyEye)"; content:"|19|testtestingpotatoes111222|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thewinavs.com (Spyware)"; content:"|09|thewinavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup time-zoneserver.com (Botnet_C&C)"; content:"|0f|time-zoneserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tisemufydiruv.com (Spyware)"; content:"|0d|tisemufydiruv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tournamentavs.com (Spyware)"; content:"|0d|tournamentavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficconverter.org (Malware_Distribution)"; content:"|10|trafficconverter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficconverter2.biz (Malware_Distribution)"; content:"|11|trafficconverter2|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trayrun.com (Malware_Distribution)"; content:"|07|trayrun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trojansantivirxp.com (Fake_AV)"; content:"|10|trojansantivirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyripipehibap.com (Spyware)"; content:"|0d|tyripipehibap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uptodate-software.com (Botnet_C&C)"; content:"|11|uptodate-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vavuragol.com (Spyware)"; content:"|09|vavuragol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vegylaheraf.com (Spyware)"; content:"|0b|vegylaheraf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vilifeqimysu.com (Malware_Infectors)"; content:"|0c|vilifeqimysu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-scanner-win-protection.com (Fake_AV)"; content:"|1c|virus-scanner-win-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voltsmobi.com (Malware_Distribution)"; content:"|09|voltsmobi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsantivirxp.com (Fake_AV)"; content:"|0b|vsantivirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vswinantivirxp.com (Fake_AV)"; content:"|0e|vswinantivirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuviwuwufi.com (Spyware)"; content:"|0a|vuviwuwufi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-stream-movies.com (Malware_Distribution)"; content:"|13|watch-stream-movies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-stream-video.net (Malware_Distribution)"; content:"|10|web-stream-video|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webantivirusscano.com (Fake_AV)"; content:"|11|webantivirusscano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmoviezone.net (Malware_Distribution)"; content:"|0c|webmoviezone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webvideoarea.net (Malware_Distribution)"; content:"|0c|webvideoarea|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webviruscheck1.com (Fake_AV)"; content:"|0e|webviruscheck1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webviruscheck5.com (Fake_AV)"; content:"|0e|webviruscheck5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webwinantivirxp.com (Fake_AV)"; content:"|0f|webwinantivirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win32dll-server.com (Botnet_C&C)"; content:"|0f|win32dll-server|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winagainstvirxp.com (Spyware)"; content:"|0f|winagainstvirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winantivirusxp.com (Fake_AV)"; content:"|0e|winantivirusxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winantivirxp.com (Fake_AV)"; content:"|0c|winantivirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winantivirxponline.com (Fake_AV)"; content:"|12|winantivirxponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winantivirxvs.com (Fake_AV)"; content:"|0d|winantivirxvs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winapartheidvirxp.com (Spyware)"; content:"|11|winapartheidvirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winavsgroup.com (Spyware)"; content:"|0b|winavsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winavsonline.com (Spyware)"; content:"|0c|winavsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winsecuresoftorder.com (Botnet_C&C)"; content:"|12|winsecuresoftorder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winter-sports2010.com (Malware_Distribution)"; content:"|11|winter-sports2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winter2010-games.com (Malware_Distribution)"; content:"|10|winter2010-games|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winwarvirusxp.com (Fake_AV)"; content:"|0d|winwarvirusxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winwarvirxp.com (Spyware)"; content:"|0b|winwarvirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winxp7server.com (Botnet_C&C)"; content:"|0c|winxp7server|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winzip-software.com (Malware_Distribution)"; content:"|0f|winzip-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wire-download-2010.com (Malware_Distribution)"; content:"|12|wire-download-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wire-new-download.com (Malware_Distribution)"; content:"|11|wire-new-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wjaxoxeh.cn (Malware_Distribution)"; content:"|08|wjaxoxeh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woranyrypylu.com (Spyware)"; content:"|0c|woranyrypylu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup world-phone-calls.com (Malware_Distribution)"; content:"|11|world-phone-calls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldcup-tvonline.com (Malware_Distribution)"; content:"|11|worldcup-tvonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldcuptvlive.com (Malware_Distribution)"; content:"|0e|worldcuptvlive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woxijaquhiqal.com (Spyware)"; content:"|0d|woxijaquhiqal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpupadop.cn (Malware_Distribution)"; content:"|08|wpupadop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrestling-live-online.com (Malware_Distribution)"; content:"|15|wrestling-live-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrorupex.cn (Malware_Distribution)"; content:"|08|wrorupex|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wvahexip.cn (Malware_Distribution)"; content:"|08|wvahexip|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wyfymabijahiw.com (Spyware)"; content:"|0d|wyfymabijahiw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xceyadij.cn (Malware_Distribution)"; content:"|08|xceyadij|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xesjedul.cn (Malware_Distribution)"; content:"|08|xesjedul|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xguxerob.cn (Malware_Distribution)"; content:"|08|xguxerob|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xleyaguh.cn (Malware_Distribution)"; content:"|08|xleyaguh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xwhoisdns.com (Malware_Distribution)"; content:"|09|xwhoisdns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoo-instantmessenger.com (Malware_Distribution)"; content:"|16|yahoo-instantmessenger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourinfohome.com (Botnet_C&C)"; content:"|0c|yourinfohome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursupercars.com (Botnet_C&C)"; content:"|0d|yoursupercars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youtorent.com (Malware_Distribution)"; content:"|09|youtorent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youtorrents.com (Malware_Distribution)"; content:"|0b|youtorrents|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youtubenewvideos.com (Botnet_C&C)"; content:"|10|youtubenewvideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yufezzc.cn (Malware_Distribution)"; content:"|07|yufezzc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zekxowiv.cn (Malware_Distribution)"; content:"|08|zekxowiv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zelokovixoqe.com (SEO_Fraud)"; content:"|0c|zelokovixoqe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zend7software.com (Botnet_C&C)"; content:"|0d|zend7software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zepihacil.com (Spyware)"; content:"|09|zepihacil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziwuconogeces.com (Spyware)"; content:"|0d|ziwuconogeces|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zmusic-downloads.com (Malware_Distribution)"; content:"|10|zmusic-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup znakomstsvo.com (Botnet_C&C)"; content:"|0b|znakomstsvo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup znakomstvatoday.com (Botnet_C&C)"; content:"|0f|znakomstvatoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup znakomstvos.com (Botnet_C&C)"; content:"|0b|znakomstvos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zytijywyqexula.com (SEO_Fraud)"; content:"|0e|zytijywyqexula|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zyzupalotem.com (Spyware)"; content:"|0b|zyzupalotem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gossipedia.com (Malware_Distribution)"; content:"|0a|gossipedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shemag.com.pk (Malware_Distribution)"; content:"|06|shemag|03|com|02|pk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allvideo.org.uk (Malware_Distribution)"; content:"|08|allvideo|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c2cservices.co.in (Malware_Distribution)"; content:"|0b|c2cservices|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galacticstall.ru (Malware_Distribution)"; content:"|0d|galacticstall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-stats45.info (Malware_Distribution)"; content:"|0e|google-stats45|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchnew.net (Malware_Distribution)"; content:"|09|searchnew|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tetrall.com (Malware_Distribution)"; content:"|07|tetrall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-life.org (Malware_Distribution)"; content:"|0b|online-life|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afiveless.com (Spyware)"; content:"|09|afiveless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aievb.com ()"; content:"|05|aievb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americanpoloavs.com (Spyware)"; content:"|0f|americanpoloavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analyticgoogle.net (Malware_Distribution)"; content:"|0e|analyticgoogle|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyst.com (Fake_AV)"; content:"|09|antispyst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyst.net (Fake_AV)"; content:"|09|antispyst|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avblckscan.com (Spyware)"; content:"|0a|avblckscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aveesca.co.cc (Spyware)"; content:"|07|aveesca|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avgreenscan.com (Spyware)"; content:"|0b|avgreenscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avkok.com (Spyware)"; content:"|05|avkok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avkokxp.com (Spyware)"; content:"|07|avkokxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avless.com (Spyware)"; content:"|06|avless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avoffxp.com (Spyware)"; content:"|07|avoffxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avoops.com (Spyware)"; content:"|06|avoops|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-jazz.com (Spyware)"; content:"|08|avs-jazz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-jive.com (Spyware)"; content:"|08|avs-jive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-music.com (Spyware)"; content:"|09|avs-music|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-swing.com (Spyware)"; content:"|09|avs-swing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsa-daisy.com (Spyware)"; content:"|0a|avsa-daisy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsblcamericanstatecan.com (Spyware)"; content:"|16|avsblcamericanstatecan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsblckscan.com (Spyware)"; content:"|0b|avsblckscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsblcksplayoffs.com (Spyware)"; content:"|10|avsblcksplayoffs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsbluescan.com (Spyware)"; content:"|0b|avsbluescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsdixieland.com (Spyware)"; content:"|0c|avsdixieland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsdon.com (Spyware)"; content:"|06|avsdon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsgo.com (Spyware)"; content:"|05|avsgo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsgreencan.com (Spyware)"; content:"|0b|avsgreencan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsgreenscangroup.com (Spyware)"; content:"|11|avsgreenscangroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsgreenscaninc.com (Spyware)"; content:"|0f|avsgreenscaninc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsgreenscanonline.com (Spyware)"; content:"|12|avsgreenscanonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsgreenspassword.com (Spyware)"; content:"|11|avsgreenspassword|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avskok.com (Spyware)"; content:"|06|avskok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avskokepub.com (Spyware)"; content:"|0a|avskokepub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsless.com (Spyware)"; content:"|07|avsless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avslessgroup.com (Spyware)"; content:"|0c|avslessgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avslessinc.com (Spyware)"; content:"|0a|avslessinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avslessnail.com (Spyware)"; content:"|0b|avslessnail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsll.com (Spyware)"; content:"|05|avsll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsllgroup.com (Spyware)"; content:"|0a|avsllgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsoffxp.com (Spyware)"; content:"|08|avsoffxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsoffxpgroup.com (Spyware)"; content:"|0d|avsoffxpgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsoffxpinning.com (Spyware)"; content:"|0e|avsoffxpinning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsoffxponline.com (Spyware)"; content:"|0e|avsoffxponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avssorry.com (Spyware)"; content:"|08|avssorry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsxpoff.com (Spyware)"; content:"|08|avsxpoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsxpoffgroup.com (Spyware)"; content:"|0d|avsxpoffgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsxpoffonline.com (Spyware)"; content:"|0e|avsxpoffonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avxpoff.com (Spyware)"; content:"|07|avxpoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babisotot.com (Malware_Distribution)"; content:"|09|babisotot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bakubuniho.com (Malware_Infectors)"; content:"|0a|bakubuniho|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basydiduwahaw.com (Malware_Distribution)"; content:"|0d|basydiduwahaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baxivenom.com (Malware_Infectors)"; content:"|09|baxivenom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beachpoloavs.com (Spyware)"; content:"|0c|beachpoloavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betakywaxekof.com (Malware_Distribution)"; content:"|0d|betakywaxekof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betavs.com (Spyware)"; content:"|06|betavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betavsgroup.com (Spyware)"; content:"|0b|betavsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigoxefyfaluh.com (Malware_Infectors)"; content:"|0d|bigoxefyfaluh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bikepoloavs.com (Spyware)"; content:"|0b|bikepoloavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bipakypusiby.com (Malware_Infectors)"; content:"|0c|bipakypusiby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blowavs.com (Spyware)"; content:"|07|blowavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bnetns.ru ()"; content:"|06|bnetns|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxisosypi.com (Malware_Distribution)"; content:"|0a|boxisosypi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bozygawunefi.com (Malware_Distribution)"; content:"|0c|bozygawunefi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bucoqypynynej.com (Malware_Infectors)"; content:"|0d|bucoqypynynej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bytypupecex.com (Malware_Infectors)"; content:"|0b|bytypupecex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cacirowec.com (Malware_Distribution)"; content:"|09|cacirowec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cagolasevaj.com (Malware_Infectors)"; content:"|0b|cagolasevaj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cajikohinele.com (Malware_Infectors)"; content:"|0c|cajikohinele|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup califepro.com (Malware_Distribution)"; content:"|09|califepro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capurasaf.com (Malware_Distribution)"; content:"|09|capurasaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheappoloavs.com (Spyware)"; content:"|0c|cheappoloavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cilybodyd.com (Malware_Distribution)"; content:"|09|cilybodyd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computerplaces.info (Malware_Infectors)"; content:"|0e|computerplaces|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cudokopipi.com (Spyware)"; content:"|0a|cudokopipi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuneqyqetyroj.com (Spyware)"; content:"|0d|cuneqyqetyroj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup custompoloavs.com (Spyware)"; content:"|0d|custompoloavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cygogonabeq.com (Malware_Distribution)"; content:"|0b|cygogonabeq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cynyhafyzetov.com (Malware_Distribution)"; content:"|0d|cynyhafyzetov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dadesignlive.com (Malware_Distribution)"; content:"|0c|dadesignlive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup danoduc.wo.tc (Spyware)"; content:"|07|danoduc|02|wo|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deletevsgreenscan.com (Spyware)"; content:"|11|deletevsgreenscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dihisalyh.com (Spyware)"; content:"|09|dihisalyh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diwamajucovy.com (Malware_Distribution)"; content:"|0c|diwamajucovy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dowemawema.com (Spyware)"; content:"|0a|dowemawema|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dytebyhekaqa.com (Spyware)"; content:"|0c|dytebyhekaqa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eacvb.com ()"; content:"|05|eacvb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eievb.com ()"; content:"|05|eievb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eonvb.com ()"; content:"|05|eonvb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epubvskok.com (Spyware)"; content:"|09|epubvskok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeabscan.com (Spyware)"; content:"|09|eyeabscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeavscan.com (Spyware)"; content:"|09|eyeavscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeavsexamine.com (Spyware)"; content:"|0d|eyeavsexamine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeavsscan.com (Spyware)"; content:"|0a|eyeavsscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeavsscanonline.com (Spyware)"; content:"|10|eyeavsscanonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeavssee.com (Spyware)"; content:"|09|eyeavssee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeavstaylor.com (Spyware)"; content:"|0c|eyeavstaylor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyereaderavs.com (Spyware)"; content:"|0c|eyereaderavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyereaderavsxp.com (Spyware)"; content:"|0e|eyereaderavsxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyescannerav.com (Spyware)"; content:"|0c|eyescannerav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyescanneravs.com (Spyware)"; content:"|0d|eyescanneravs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyescanneravsgroup.com (Spyware)"; content:"|12|eyescanneravsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyescanneravxp.com (Spyware)"; content:"|0e|eyescanneravxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fakovuhuju.com (Spyware)"; content:"|0a|fakovuhuju|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fifotojylahe.com (Spyware)"; content:"|0c|fifotojylahe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filteringlavs.com (Spyware)"; content:"|0d|filteringlavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fohohovugoredo.com (Malware_Distribution)"; content:"|0e|fohohovugoredo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foqadobyve.com (Malware_Distribution)"; content:"|0a|foqadobyve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyhykubux.com (Malware_Distribution)"; content:"|09|fyhykubux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gasavs.com (Spyware)"; content:"|06|gasavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gasavsgroup.com (Spyware)"; content:"|0b|gasavsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gasavsonline.com (Spyware)"; content:"|0c|gasavsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gasicekymas.com (Spyware)"; content:"|0b|gasicekymas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gavorydigejizy.com (Malware_Distribution)"; content:"|0e|gavorydigejizy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geduhijykes.com (Malware_Infectors)"; content:"|0b|geduhijykes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gidewuboler.com (Malware_Infectors)"; content:"|0b|gidewuboler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gilebifabusexa.com (Spyware)"; content:"|0e|gilebifabusexa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gilodivere.com (Malware_Infectors)"; content:"|0a|gilodivere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giwomylywokof.com (Malware_Infectors)"; content:"|0d|giwomylywokof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalpoloavs.com (Spyware)"; content:"|0d|globalpoloavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goinprivate.com (Spyware)"; content:"|0b|goinprivate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h3456345.cn (Malware_Distribution)"; content:"|08|h3456345|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hawaiipoloavs.com (Spyware)"; content:"|0d|hawaiipoloavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hebypudukotih.com (Spyware)"; content:"|0d|hebypudukotih|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hifoqaxinaj.com (Malware_Distribution)"; content:"|0b|hifoqaxinaj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hupnb.com ()"; content:"|05|hupnb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inningavsxpoff.com (Spyware)"; content:"|0e|inningavsxpoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inningvsoffxp.com (Spyware)"; content:"|0d|inningvsoffxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jocusacegir.com (Malware_Distribution)"; content:"|0b|jocusacegir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jojevijehajyx.com (Spyware)"; content:"|0d|jojevijehajyx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jukecoruvut.com (Spyware)"; content:"|0b|jukecoruvut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jywujodocivine.com (Spyware)"; content:"|0e|jywujodocivine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kesykijigut.com (Malware_Distribution)"; content:"|0b|kesykijigut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kilumixefiki.com (Malware_Distribution)"; content:"|0c|kilumixefiki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kyqegovujug.com (Malware_Distribution)"; content:"|0b|kyqegovujug|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakersscanneravs.com (Spyware)"; content:"|10|lakersscanneravs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lessavs.com (Spyware)"; content:"|07|lessavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lessavsinc.com (Spyware)"; content:"|0a|lessavsinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lessavsonline.com (Spyware)"; content:"|0d|lessavsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lettervs.com (Spyware)"; content:"|08|lettervs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lidvb.com ()"; content:"|05|lidvb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llanorthwestern.com (Spyware)"; content:"|0f|llanorthwestern|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llavsonline.com (Spyware)"; content:"|0b|llavsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logafive.com (Spyware)"; content:"|08|logafive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logapacquiao.com (Spyware)"; content:"|0c|logapacquiao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logav.com (Spyware)"; content:"|05|logav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logavs.com (Spyware)"; content:"|06|logavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logavsgroup.com (Spyware)"; content:"|0b|logavsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logavsmanny.com (Spyware)"; content:"|0b|logavsmanny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logavsonline.com (Spyware)"; content:"|0c|logavsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loseavs.com (Spyware)"; content:"|07|loseavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luqotazih.com (Malware_Infectors)"; content:"|09|luqotazih|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lutheranantivirxp.com (Fake_AV)"; content:"|11|lutheranantivirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lutherantivirxp.com (Fake_AV)"; content:"|0f|lutherantivirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lysocoharogyg.com (Spyware)"; content:"|0d|lysocoharogyg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lywicoxyvuby.com (Malware_Distribution)"; content:"|0c|lywicoxyvuby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m00vable-fiesta.com (Botnet_C&C)"; content:"|0f|m00vable-fiesta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mannyavs.com (Spyware)"; content:"|08|mannyavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mannybetavs.com (Spyware)"; content:"|0b|mannybetavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mavsloidol.com (Spyware)"; content:"|0a|mavsloidol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mecaqyvupi.com (Malware_Distribution)"; content:"|0a|mecaqyvupi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mezibehab.com (Malware_Infectors)"; content:"|09|mezibehab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mufobapix.com (Malware_Distribution)"; content:"|09|mufobapix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavsblckscan.com (Spyware)"; content:"|0d|myavsblckscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavsboom.com (Spyware)"; content:"|09|myavsboom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavsdam.com (Spyware)"; content:"|08|myavsdam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavsgreenscan.com (Spyware)"; content:"|0e|myavsgreenscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavsoffxp.com (Spyware)"; content:"|0a|myavsoffxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavsxpoff.com (Spyware)"; content:"|0a|myavsxpoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mybetavs.com (Spyware)"; content:"|08|mybetavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myeyeavsscan.com (Spyware)"; content:"|0c|myeyeavsscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myeyescanneravs.com (Spyware)"; content:"|0f|myeyescanneravs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mygasavs.com (Spyware)"; content:"|08|mygasavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mygolavs.com (Spyware)"; content:"|08|mygolavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myllavs.com (Spyware)"; content:"|07|myllavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylogavs.com (Spyware)"; content:"|08|mylogavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myporeavs.com (Spyware)"; content:"|09|myporeavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywinantivirusxp.com (Fake_AV)"; content:"|10|mywinantivirusxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywinavs.com (Spyware)"; content:"|08|mywinavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nabubymepicizu.com (Malware_Distribution)"; content:"|0e|nabubymepicizu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ncaaavs.com (Spyware)"; content:"|07|ncaaavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavsblckscan.com (Spyware)"; content:"|0e|newavsblckscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavsboom.com (Spyware)"; content:"|0a|newavsboom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavsdam.com (Spyware)"; content:"|09|newavsdam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavsgreenscan.com (Spyware)"; content:"|0f|newavsgreenscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavsll.com (Spyware)"; content:"|08|newavsll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavsoffxp.com (Spyware)"; content:"|0b|newavsoffxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavspridewin.com (Spyware)"; content:"|0e|newavspridewin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavsxpoff.com (Spyware)"; content:"|0b|newavsxpoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbetavs.com (Spyware)"; content:"|09|newbetavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neweyeavsscan.com (Spyware)"; content:"|0d|neweyeavsscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neweyescanneravs.com (Spyware)"; content:"|10|neweyescanneravs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newgasavs.com (Spyware)"; content:"|09|newgasavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newgolavs.com (Spyware)"; content:"|09|newgolavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newlessavs.com (Spyware)"; content:"|0a|newlessavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newllavs.com (Spyware)"; content:"|08|newllavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newlogavs.com (Spyware)"; content:"|09|newlogavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newporeavs.com (Spyware)"; content:"|0a|newporeavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newwinavs.com (Spyware)"; content:"|09|newwinavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nihedimes.com (Malware_Distribution)"; content:"|09|nihedimes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nodihykyhopyz.com (Malware_Distribution)"; content:"|0d|nodihykyhopyz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nupecehededave.com (Malware_Distribution)"; content:"|0e|nupecehededave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nupnb.com ()"; content:"|05|nupnb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oilavs.com (Spyware)"; content:"|06|oilavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup owavb.com ()"; content:"|05|owavb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pacquiaologavs.com (Spyware)"; content:"|0e|pacquiaologavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup passportantivirusxp.com (Fake_AV)"; content:"|13|passportantivirusxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup passwordavsgreenscan.com (Spyware)"; content:"|14|passwordavsgreenscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup passwordvsgreenscan.com (Spyware)"; content:"|13|passwordvsgreenscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piavb.com ()"; content:"|05|piavb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pipugodupexug.com (Spyware)"; content:"|0d|pipugodupexug|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playoffsvsblckscan.com (Spyware)"; content:"|12|playoffsvsblckscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polossavs.com (Spyware)"; content:"|09|polossavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poqacelufeq.com (Malware_Distribution)"; content:"|0b|poqacelufeq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poreafigure.com (Spyware)"; content:"|0b|poreafigure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poreav.com (Spyware)"; content:"|06|poreav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poreavsgroup.com (Spyware)"; content:"|0c|poreavsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poreavsonline.com (Spyware)"; content:"|0d|poreavsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup potasajic.com (Malware_Infectors)"; content:"|09|potasajic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premiumantivirusfreescan.com (Fake_AV)"; content:"|18|premiumantivirusfreescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premiumfreescan.com (Spyware)"; content:"|0f|premiumfreescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pulirutugeqaf.com (Spyware)"; content:"|0d|pulirutugeqaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup punanufawenyk.com (Spyware)"; content:"|0d|punanufawenyk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puvepydilaj.com (Malware_Distribution)"; content:"|0b|puvepydilaj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qatijoxuna.com (Malware_Distribution)"; content:"|0a|qatijoxuna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qikawykytapysy.com (Malware_Distribution)"; content:"|0e|qikawykytapysy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qixaxyrujuqici.com (Malware_Distribution)"; content:"|0e|qixaxyrujuqici|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qovukezur.com (Spyware)"; content:"|09|qovukezur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qukocacilogoti.com (Spyware)"; content:"|0e|qukocacilogoti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qyfimeluxeqok.com (Malware_Distribution)"; content:"|0d|qyfimeluxeqok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ranamujesu.com (Malware_Infectors)"; content:"|0a|ranamujesu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recabikixyse.com (Malware_Distribution)"; content:"|0c|recabikixyse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rhpavsxpoff.com (Spyware)"; content:"|0b|rhpavsxpoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rhpvsxpoff.com (Spyware)"; content:"|0a|rhpvsxpoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rinepigelowot.com (Malware_Distribution)"; content:"|0d|rinepigelowot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ronadosim.com (Spyware)"; content:"|09|ronadosim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rsravs.com (Spyware)"; content:"|06|rsravs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rugabujotidil.com (Malware_Distribution)"; content:"|0d|rugabujotidil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruvahekamefan.com (Malware_Distribution)"; content:"|0d|ruvahekamefan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salysymyp.com (Malware_Infectors)"; content:"|09|salysymyp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savicypacy.com (Malware_Distribution)"; content:"|0a|savicypacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seekartists.com (Malware_Distribution)"; content:"|0b|seekartists|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seiningcarno.co.cc (Malware_Infectors)"; content:"|0c|seiningcarno|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup semuvajako.com (Malware_Infectors)"; content:"|0a|semuvajako|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sixihyqecyfuku.com (Spyware)"; content:"|0e|sixihyqecyfuku|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snailessavs.com (Spyware)"; content:"|0b|snailessavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sobudajib.com (Malware_Infectors)"; content:"|09|sobudajib|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonycojaqowik.com (Malware_Distribution)"; content:"|0d|sonycojaqowik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syfurojoxereku.com (Spyware)"; content:"|0e|syfurojoxereku|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxhiking.com (Malware_Distribution)"; content:"|09|taxhiking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tayloravsscan.com (Spyware)"; content:"|0d|tayloravsscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tedowuveqakej.com (Malware_Infectors)"; content:"|0d|tedowuveqakej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantivscanfree.com (Spyware)"; content:"|10|theantivscanfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theavsblckscan.com (Spyware)"; content:"|0e|theavsblckscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theavsboom.com (Spyware)"; content:"|0a|theavsboom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theavsdam.com (Spyware)"; content:"|09|theavsdam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theavsgreenscan.com (Spyware)"; content:"|0f|theavsgreenscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theavsoffxp.com (Spyware)"; content:"|0b|theavsoffxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theavspridewin.com (Spyware)"; content:"|0e|theavspridewin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theavsxpoff.com (Spyware)"; content:"|0b|theavsxpoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebetavs.com (Spyware)"; content:"|09|thebetavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theeyeavsscan.com (Spyware)"; content:"|0d|theeyeavsscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thegasavs.com (Spyware)"; content:"|09|thegasavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thegolavs.com (Spyware)"; content:"|09|thegolavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelessavs.com (Spyware)"; content:"|0a|thelessavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelogavs.com (Spyware)"; content:"|09|thelogavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thewinantivirxp.com (Fake_AV)"; content:"|0f|thewinantivirxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tinocusebawu.com (Malware_Infectors)"; content:"|0c|tinocusebawu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup togizypad.com (Malware_Distribution)"; content:"|09|togizypad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsunepspatiz.co.cc (Malware_Infectors)"; content:"|0c|tsunepspatiz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tumevamusytoc.com (Malware_Distribution)"; content:"|0d|tumevamusytoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turezidejuzok.com (Malware_Distribution)"; content:"|0d|turezidejuzok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tutupeqyrar.com (Spyware)"; content:"|0b|tutupeqyrar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuwifotiju.com (Malware_Infectors)"; content:"|0a|tuwifotiju|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tycalinumijotu.com (Malware_Distribution)"; content:"|0e|tycalinumijotu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tytunajilac.com (Malware_Distribution)"; content:"|0b|tytunajilac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unimed.com.tr (Malware_Distribution)"; content:"|06|unimed|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vadyrokufubu.com (Malware_Distribution)"; content:"|0c|vadyrokufubu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vefyqylepahuga.com (Malware_Infectors)"; content:"|0e|vefyqylepahuga|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vehepumac.com (Spyware)"; content:"|09|vehepumac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vekoxarotucev.com (Malware_Distribution)"; content:"|0d|vekoxarotucev|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vepizujefewa.com (Malware_Distribution)"; content:"|0c|vepizujefewa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video-playerpro.com (Malware_Distribution)"; content:"|0f|video-playerpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vikitarurepuq.com (Malware_Distribution)"; content:"|0d|vikitarurepuq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virafix.com (Malware_Distribution)"; content:"|07|virafix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viraltraffic-guide.com (Malware_Distribution)"; content:"|12|viraltraffic-guide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vivasidasaves.com (Malware_Distribution)"; content:"|0d|vivasidasaves|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkodewol.cn (Malware_Distribution)"; content:"|08|vkodewol|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voice-ip-download.com (Malware_Distribution)"; content:"|11|voice-ip-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voip-2010-download.com (Malware_Distribution)"; content:"|12|voip-2010-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voip-2010-new-download.com (Malware_Distribution)"; content:"|16|voip-2010-new-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voip-2011-version.com (Malware_Distribution)"; content:"|11|voip-2011-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voip-access-now.com (Malware_Distribution)"; content:"|0f|voip-access-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voip-new-online-download.com (Malware_Distribution)"; content:"|18|voip-new-online-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voip-official-download.com (Malware_Distribution)"; content:"|16|voip-official-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vovyjaryguwu.com (Malware_Distribution)"; content:"|0c|vovyjaryguwu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsefurug.cn (Malware_Distribution)"; content:"|08|vsefurug|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vtuyocew.cn (Malware_Distribution)"; content:"|08|vtuyocew|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vywobohexinipa.com (Spyware)"; content:"|0e|vywobohexinipa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waginujiwoha.com (Malware_Distribution)"; content:"|0c|waginujiwoha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-football-tv-live.com (Malware_Distribution)"; content:"|16|watch-football-tv-live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-hd-movies-online.com (Malware_Distribution)"; content:"|16|watch-hd-movies-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-hockey-online.net (Malware_Distribution)"; content:"|13|watch-hockey-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-hockeyonline.com (Malware_Distribution)"; content:"|12|watch-hockeyonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-live-2010-football.com (Malware_Distribution)"; content:"|18|watch-live-2010-football|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-online-basketball.com (Malware_Distribution)"; content:"|17|watch-online-basketball|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-online-boxing.com (Malware_Distribution)"; content:"|13|watch-online-boxing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-sports-network.com (Malware_Distribution)"; content:"|14|watch-sports-network|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-superbowl-online.com (Malware_Distribution)"; content:"|16|watch-superbowl-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-ufc-live.com (Malware_Distribution)"; content:"|0e|watch-ufc-live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-ufc-online.com (Malware_Distribution)"; content:"|10|watch-ufc-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watchonline-football.com (Malware_Distribution)"; content:"|14|watchonline-football|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup website-support.ru (Malware_Distribution)"; content:"|0f|website-support|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wedytatuxug.com (Spyware)"; content:"|0b|wedytatuxug|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wenomepodipiby.com (Malware_Distribution)"; content:"|0e|wenomepodipiby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wetyotix.cn (Malware_Distribution)"; content:"|08|wetyotix|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wihoraqite.com (Malware_Distribution)"; content:"|0a|wihoraqite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiqesidavevod.com (Malware_Infectors)"; content:"|0d|wiqesidavevod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wirybidyzufij.com (Spyware)"; content:"|0d|wirybidyzufij|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wupnb.com ()"; content:"|05|wupnb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xajizukoxo.com (Spyware)"; content:"|0a|xajizukoxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xeruraxagum.com (Malware_Infectors)"; content:"|0b|xeruraxagum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xifuzakotyk.com (Spyware)"; content:"|0b|xifuzakotyk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ximeqeteporaco.com (Malware_Distribution)"; content:"|0e|ximeqeteporaco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xisohyrydily.com (Malware_Distribution)"; content:"|0c|xisohyrydily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xynixucujeduru.com (Spyware)"; content:"|0e|xynixucujeduru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yupbn.com ()"; content:"|05|yupbn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zizudadidura.com (Malware_Infectors)"; content:"|0c|zizudadidura|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zizyhaqizod.com (Malware_Infectors)"; content:"|0b|zizyhaqizod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zyejanag.cn (Malware_Distribution)"; content:"|08|zyejanag|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zymaqamusowibu.com (Malware_Distribution)"; content:"|0e|zymaqamusowibu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup picsicio.us (Malware_Distribution)"; content:"|08|picsicio|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobejam.in (Botnet_C&C)"; content:"|08|adobejam|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusscano.com (Fake_AV)"; content:"|0e|antivirusscano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusscanopor.com (Fake_AV)"; content:"|11|antivirusscanopor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusseeo.com (Fake_AV)"; content:"|0d|antivirusseeo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzabortion.com (Fake_AV)"; content:"|11|antiviruzabortion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzmuslim.com (Fake_AV)"; content:"|0f|antiviruzmuslim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzreader.com (Fake_AV)"; content:"|0f|antiviruzreader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzscanner.com (Fake_AV)"; content:"|10|antiviruzscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzscannerabortion.com (Fake_AV)"; content:"|18|antiviruzscannerabortion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzscannergroup.com (Fake_AV)"; content:"|15|antiviruzscannergroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzscanneronline.com (Fake_AV)"; content:"|16|antiviruzscanneronline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzscannerxpgroup.com (Fake_AV)"; content:"|17|antiviruzscannerxpgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzscannerxpmuslim.com (Fake_AV)"; content:"|18|antiviruzscannerxpmuslim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruzscannerxponline.com (Fake_AV)"; content:"|18|antiviruzscannerxponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivoltfreevirusscan.com (Fake_AV)"; content:"|15|antivoltfreevirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivoltgamesfreevirusscan.com (Fake_AV)"; content:"|1a|antivoltgamesfreevirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivplayfreevirusscan.com (Fake_AV)"; content:"|16|antivplayfreevirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asweds.com (Malware_Distribution)"; content:"|06|asweds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bawaltaxi.com (Malware_Distribution)"; content:"|09|bawaltaxi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bervert.osa.pl (Spyware)"; content:"|07|bervert|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitschoonerop.com (Zeus_Zbot_SpyEye)"; content:"|0d|bitschoonerop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookavio.com (SEO_Fraud)"; content:"|08|bookavio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booknunu.com (SEO_Fraud)"; content:"|08|booknunu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booksolo.com (SEO_Fraud)"; content:"|08|booksolo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booktuba.com (SEO_Fraud)"; content:"|08|booktuba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookvila.com (SEO_Fraud)"; content:"|08|bookvila|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapscannerxpprotection.com (Spyware)"; content:"|18|cheapscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clashjamwallop.in (Botnet_C&C)"; content:"|0e|clashjamwallop|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diagnosticscannerprotectionfast.com (Spyware)"; content:"|1f|diagnosticscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diagnosticscannerprotectionfree.com (Spyware)"; content:"|1f|diagnosticscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diagnosticscannerprotectionxp.com (Spyware)"; content:"|1d|diagnosticscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diagnosticscannerwinprotection.com (Spyware)"; content:"|1e|diagnosticscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diagnosticscannerxpprotection.com (Spyware)"; content:"|1d|diagnosticscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalscannerantiv.com (Spyware)"; content:"|13|digitalscannerantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalscannerprotectionfast.com (Spyware)"; content:"|1c|digitalscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalscannerprotectionfree.com (Spyware)"; content:"|1c|digitalscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalscannerprotectionwin.com (Spyware)"; content:"|1b|digitalscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalscannerprotectionxp.com (Spyware)"; content:"|1a|digitalscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalscannerwinprotection.com (Spyware)"; content:"|1b|digitalscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalscannerxpprotection.com (Spyware)"; content:"|1a|digitalscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup disk-image.info (Malware_Distribution)"; content:"|0a|disk-image|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnhrtnw.co.cc (Malware_Infectors)"; content:"|07|dnhrtnw|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dorbellpregnant.com (Zeus_Zbot_SpyEye)"; content:"|0f|dorbellpregnant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanarm.net (Zeus_Zbot_SpyEye)"; content:"|06|fanarm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finditnow.osa.pl (Spyware)"; content:"|09|finditnow|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flash2011business.net ()"; content:"|11|flash2011business|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz10news.com ()"; content:"|0e|flashbiz10news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz1news.com ()"; content:"|0d|flashbiz1news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz2news.com ()"; content:"|0d|flashbiz2news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz3news.com ()"; content:"|0d|flashbiz3news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz4news.com ()"; content:"|0d|flashbiz4news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz5news.com ()"; content:"|0d|flashbiz5news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz6news.com ()"; content:"|0d|flashbiz6news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz7news.com ()"; content:"|0d|flashbiz7news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz8news.com ()"; content:"|0d|flashbiz8news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashbiz9news.com ()"; content:"|0d|flashbiz9news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashplayer-10-download.com (Malware_Distribution)"; content:"|17|flashplayer-10-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashplayer10download.com (Malware_Distribution)"; content:"|15|flashplayer10download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foodstampdirect.org (Malware_Distribution)"; content:"|0f|foodstampdirect|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup football-tv-live-online.com (Malware_Distribution)"; content:"|17|football-tv-live-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-movienow.com (Malware_Distribution)"; content:"|0d|free-movienow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freedownloadzone.com (Malware_Distribution)"; content:"|10|freedownloadzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freedownloadzone.ph (Malware_Distribution)"; content:"|10|freedownloadzone|02|ph"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freemovie-now.com (Malware_Distribution)"; content:"|0d|freemovie-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewinboundaryscanantivir.com (Fake_AV)"; content:"|1a|freewinboundaryscanantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewinlaserscanantivir.com (Fake_AV)"; content:"|17|freewinlaserscanantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewinliverscanantivir.com (Fake_AV)"; content:"|17|freewinliverscanantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewinlungscanantivir.com (Fake_AV)"; content:"|16|freewinlungscanantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewinquickscanantivir.com (Fake_AV)"; content:"|17|freewinquickscanantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frhjkykerfwfff.com (Malware_Distribution)"; content:"|0e|frhjkykerfwfff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fsjdhfgqhujjj.com (Malware_Distribution)"; content:"|0d|fsjdhfgqhujjj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fteqimop.cn (Malware_Distribution)"; content:"|08|fteqimop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftpclient-new.com (Malware_Distribution)"; content:"|0d|ftpclient-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-antivirus-protection.com (Fake_AV)"; content:"|19|full-antivirus-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-antivirus-solution.com (Fake_AV)"; content:"|17|full-antivirus-solution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-antivirussolution.com (Fake_AV)"; content:"|16|full-antivirussolution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-tvdownloading.com (Malware_Distribution)"; content:"|12|full-tvdownloading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-tvdownloads.com (Malware_Distribution)"; content:"|10|full-tvdownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fvuligir.cn (Malware_Distribution)"; content:"|08|fvuligir|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup game-2010-downloads.com (Malware_Distribution)"; content:"|13|game-2010-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup game-mediacenter.com (Malware_Distribution)"; content:"|10|game-mediacenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getall-togo.com (Malware_Distribution)"; content:"|0b|getall-togo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getlivefootball-tv.com (Malware_Distribution)"; content:"|12|getlivefootball-tv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getpregnant-solution.com (Malware_Distribution)"; content:"|14|getpregnant-solution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gjuryj7krwrfdd.com (Malware_Distribution)"; content:"|0e|gjuryj7krwrfdd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gkjagfdagcyqq.com (Malware_Distribution)"; content:"|0d|gkjagfdagcyqq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godfatheredition.com (Malware_Distribution)"; content:"|10|godfatheredition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1n1-guide.com (Malware_Distribution)"; content:"|0a|h1n1-guide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1n1lab.org (Malware_Distribution)"; content:"|07|h1n1lab|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1n1membersarea.com (Malware_Distribution)"; content:"|0f|h1n1membersarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup handball-channel.com (Malware_Distribution)"; content:"|10|handball-channel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardbuck.de (Malware_Distribution)"; content:"|08|hardbuck|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagescannerwinprotection.com (Spyware)"; content:"|19|imagescannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagescannerxpprotection.com (Spyware)"; content:"|18|imagescannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup injectionhax.co.cc (Zeus_Zbot_SpyEye)"; content:"|0c|injectionhax|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipanelonline.com (Malware_Distribution)"; content:"|0c|ipanelonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lhc.vg (Malware_Distribution)"; content:"|03|lhc|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkmoduledso.com (Zeus_Zbot_SpyEye)"; content:"|0d|linkmoduledso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mxdblog.info (Malware_Distribution)"; content:"|07|mxdblog|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n4gate.com (Malware_Distribution)"; content:"|06|n4gate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namewhois.ru (Malware_Distribution)"; content:"|09|namewhois|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palitraengine.co.cc (Malware_Infectors)"; content:"|0d|palitraengine|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoscannerprotectionxp.com (Spyware)"; content:"|18|photoscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoscannerwinprotection.com (Spyware)"; content:"|19|photoscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoscannerxpprotection.com (Spyware)"; content:"|18|photoscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powervorsoft.co.cc (Spyware)"; content:"|0c|powervorsoft|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-mastermme.byinter.net (Spyware)"; content:"|0e|save-mastermme|07|byinter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartvf-soft.co.cc (Spyware)"; content:"|0c|smartvf-soft|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartyauscanner.co.cc (Spyware)"; content:"|0f|smartyauscanner|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats-master111.info (Malware_Distribution)"; content:"|0f|stats-master111|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statsl.com (Malware_Distribution)"; content:"|06|statsl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tadygus.com ()"; content:"|07|tadygus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagellner.com (Botnet_C&C)"; content:"|09|tagellner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idaab.com (Malware_Distribution)"; content:"|11|transaction-idaab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idab.com (Malware_Distribution)"; content:"|10|transaction-idab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idabt.com (Malware_Distribution)"; content:"|11|transaction-idabt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idac.com (Malware_Distribution)"; content:"|10|transaction-idac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idace.com (Malware_Distribution)"; content:"|11|transaction-idace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idacn.com (Malware_Distribution)"; content:"|11|transaction-idacn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idaec.com (Malware_Distribution)"; content:"|11|transaction-idaec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idant.com (Malware_Distribution)"; content:"|11|transaction-idant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idanx.com (Malware_Distribution)"; content:"|11|transaction-idanx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idas.com (Malware_Distribution)"; content:"|10|transaction-idas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idasp.com (Malware_Distribution)"; content:"|11|transaction-idasp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idat.com (Malware_Distribution)"; content:"|10|transaction-idat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idav.com (Malware_Distribution)"; content:"|10|transaction-idav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idavr.com (Malware_Distribution)"; content:"|11|transaction-idavr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idax.com (Malware_Distribution)"; content:"|10|transaction-idax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idbkd.com (Malware_Distribution)"; content:"|11|transaction-idbkd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idbl.com (Malware_Distribution)"; content:"|10|transaction-idbl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idblg.com (Malware_Distribution)"; content:"|11|transaction-idblg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idbu.com (Malware_Distribution)"; content:"|10|transaction-idbu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idbur.com (Malware_Distribution)"; content:"|11|transaction-idbur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idca.com (Malware_Distribution)"; content:"|10|transaction-idca|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idcar.com (Malware_Distribution)"; content:"|11|transaction-idcar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idcd.com (Malware_Distribution)"; content:"|10|transaction-idcd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idcdm.com (Malware_Distribution)"; content:"|11|transaction-idcdm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idcdt.com (Malware_Distribution)"; content:"|11|transaction-idcdt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idct.com (Malware_Distribution)"; content:"|10|transaction-idct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddar.com (Malware_Distribution)"; content:"|11|transaction-iddar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddat.com (Malware_Distribution)"; content:"|11|transaction-iddat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddc.com (Malware_Distribution)"; content:"|10|transaction-iddc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddet.com (Malware_Distribution)"; content:"|11|transaction-iddet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddi.com (Malware_Distribution)"; content:"|10|transaction-iddi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddie.com (Malware_Distribution)"; content:"|11|transaction-iddie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddo.com (Malware_Distribution)"; content:"|10|transaction-iddo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddog.com (Malware_Distribution)"; content:"|11|transaction-iddog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddr.com (Malware_Distribution)"; content:"|10|transaction-iddr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddt.com (Malware_Distribution)"; content:"|10|transaction-iddt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddtv.com (Malware_Distribution)"; content:"|11|transaction-iddtv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddv.com (Malware_Distribution)"; content:"|10|transaction-iddv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-iddvd.com (Malware_Distribution)"; content:"|11|transaction-iddvd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idear.com (Malware_Distribution)"; content:"|11|transaction-idear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-ideba.com (Malware_Distribution)"; content:"|11|transaction-ideba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idec.com (Malware_Distribution)"; content:"|10|transaction-idec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idecl.com (Malware_Distribution)"; content:"|11|transaction-idecl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idef.com (Malware_Distribution)"; content:"|10|transaction-idef|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-ideg.com (Malware_Distribution)"; content:"|10|transaction-ideg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idej.com (Malware_Distribution)"; content:"|10|transaction-idej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-ideoj.com (Malware_Distribution)"; content:"|11|transaction-ideoj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idepa.com (Malware_Distribution)"; content:"|11|transaction-idepa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfd.com (Malware_Distribution)"; content:"|10|transaction-idfd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfed.com (Malware_Distribution)"; content:"|11|transaction-idfed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfit.com (Malware_Distribution)"; content:"|11|transaction-idfit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfla.com (Malware_Distribution)"; content:"|11|transaction-idfla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfor.com (Malware_Distribution)"; content:"|11|transaction-idfor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfr.com (Malware_Distribution)"; content:"|10|transaction-idfr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfre.com (Malware_Distribution)"; content:"|11|transaction-idfre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfrx.com (Malware_Distribution)"; content:"|11|transaction-idfrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfw.com (Malware_Distribution)"; content:"|10|transaction-idfw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idfwl.com (Malware_Distribution)"; content:"|11|transaction-idfwl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgam.com (Malware_Distribution)"; content:"|11|transaction-idgam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idger.com (Malware_Distribution)"; content:"|11|transaction-idger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgf.com (Malware_Distribution)"; content:"|10|transaction-idgf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgg.com (Malware_Distribution)"; content:"|10|transaction-idgg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgl.com (Malware_Distribution)"; content:"|10|transaction-idgl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgm.com (Malware_Distribution)"; content:"|10|transaction-idgm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgms.com (Malware_Distribution)"; content:"|11|transaction-idgms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgol.com (Malware_Distribution)"; content:"|11|transaction-idgol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgos.com (Malware_Distribution)"; content:"|11|transaction-idgos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgs.com (Malware_Distribution)"; content:"|10|transaction-idgs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idgtr.com (Malware_Distribution)"; content:"|11|transaction-idgtr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idh1.com (Malware_Distribution)"; content:"|10|transaction-idh1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idhw.com (Malware_Distribution)"; content:"|10|transaction-idhw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idhwr.com (Malware_Distribution)"; content:"|11|transaction-idhwr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idhy.com (Malware_Distribution)"; content:"|10|transaction-idhy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idhyp.com (Malware_Distribution)"; content:"|11|transaction-idhyp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idhys.com (Malware_Distribution)"; content:"|11|transaction-idhys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idip.com (Malware_Distribution)"; content:"|10|transaction-idip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idipd.com (Malware_Distribution)"; content:"|11|transaction-idipd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idkey.com (Malware_Distribution)"; content:"|11|transaction-idkey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idkw.com (Malware_Distribution)"; content:"|10|transaction-idkw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idkwd.com (Malware_Distribution)"; content:"|11|transaction-idkwd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idmed.com (Malware_Distribution)"; content:"|11|transaction-idmed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idmm.com (Malware_Distribution)"; content:"|10|transaction-idmm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idmob.com (Malware_Distribution)"; content:"|11|transaction-idmob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idmov.com (Malware_Distribution)"; content:"|11|transaction-idmov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idmp.com (Malware_Distribution)"; content:"|10|transaction-idmp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idms.com (Malware_Distribution)"; content:"|10|transaction-idms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idmu.com (Malware_Distribution)"; content:"|10|transaction-idmu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idmus.com (Malware_Distribution)"; content:"|11|transaction-idmus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idnc.com (Malware_Distribution)"; content:"|10|transaction-idnc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idnch.com (Malware_Distribution)"; content:"|11|transaction-idnch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idnic.com (Malware_Distribution)"; content:"|11|transaction-idnic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idoof.com (Malware_Distribution)"; content:"|11|transaction-idoof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpa.com (Malware_Distribution)"; content:"|10|transaction-idpa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpd.com (Malware_Distribution)"; content:"|10|transaction-idpd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpdo.com (Malware_Distribution)"; content:"|11|transaction-idpdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpe.com (Malware_Distribution)"; content:"|10|transaction-idpe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpen.com (Malware_Distribution)"; content:"|11|transaction-idpen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpet.com (Malware_Distribution)"; content:"|11|transaction-idpet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpf.com (Malware_Distribution)"; content:"|10|transaction-idpf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpft.com (Malware_Distribution)"; content:"|11|transaction-idpft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpia.com (Malware_Distribution)"; content:"|11|transaction-idpia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpl.com (Malware_Distribution)"; content:"|10|transaction-idpl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpo.com (Malware_Distribution)"; content:"|10|transaction-idpo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idppc.com (Malware_Distribution)"; content:"|11|transaction-idppc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idppl.com (Malware_Distribution)"; content:"|11|transaction-idppl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idprt.com (Malware_Distribution)"; content:"|11|transaction-idprt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpss.com (Malware_Distribution)"; content:"|11|transaction-idpss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idpsx.com (Malware_Distribution)"; content:"|11|transaction-idpsx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idra.com (Malware_Distribution)"; content:"|10|transaction-idra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idre.com (Malware_Distribution)"; content:"|10|transaction-idre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idrec.com (Malware_Distribution)"; content:"|11|transaction-idrec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idreg.com (Malware_Distribution)"; content:"|11|transaction-idreg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idren.com (Malware_Distribution)"; content:"|11|transaction-idren|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idres.com (Malware_Distribution)"; content:"|11|transaction-idres|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idrg.com (Malware_Distribution)"; content:"|10|transaction-idrg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idrp.com (Malware_Distribution)"; content:"|10|transaction-idrp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idrpe.com (Malware_Distribution)"; content:"|11|transaction-idrpe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsa.com (Malware_Distribution)"; content:"|10|transaction-idsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsc.com (Malware_Distribution)"; content:"|10|transaction-idsc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsea.com (Malware_Distribution)"; content:"|11|transaction-idsea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsee.com (Malware_Distribution)"; content:"|11|transaction-idsee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idseo.com (Malware_Distribution)"; content:"|11|transaction-idseo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsky.com (Malware_Distribution)"; content:"|11|transaction-idsky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsl.com (Malware_Distribution)"; content:"|10|transaction-idsl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsmu.com (Malware_Distribution)"; content:"|11|transaction-idsmu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsof.com (Malware_Distribution)"; content:"|11|transaction-idsof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsol.com (Malware_Distribution)"; content:"|11|transaction-idsol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsp.com (Malware_Distribution)"; content:"|10|transaction-idsp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idspa.com (Malware_Distribution)"; content:"|11|transaction-idspa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idspo.com (Malware_Distribution)"; content:"|11|transaction-idspo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idss.com (Malware_Distribution)"; content:"|10|transaction-idss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idsst.com (Malware_Distribution)"; content:"|11|transaction-idsst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idst.com (Malware_Distribution)"; content:"|10|transaction-idst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idstr.com (Malware_Distribution)"; content:"|11|transaction-idstr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idta.com (Malware_Distribution)"; content:"|10|transaction-idta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idtao.com (Malware_Distribution)"; content:"|11|transaction-idtao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idtat.com (Malware_Distribution)"; content:"|11|transaction-idtat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idtv.com (Malware_Distribution)"; content:"|10|transaction-idtv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idtvt.com (Malware_Distribution)"; content:"|11|transaction-idtvt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idtw.com (Malware_Distribution)"; content:"|10|transaction-idtw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idtwi.com (Malware_Distribution)"; content:"|11|transaction-idtwi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idvi.com (Malware_Distribution)"; content:"|10|transaction-idvi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idvid.com (Malware_Distribution)"; content:"|11|transaction-idvid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idvir.com (Malware_Distribution)"; content:"|11|transaction-idvir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idvp.com (Malware_Distribution)"; content:"|10|transaction-idvp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idwdo.com (Malware_Distribution)"; content:"|11|transaction-idwdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idwhs.com (Malware_Distribution)"; content:"|11|transaction-idwhs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idws.com (Malware_Distribution)"; content:"|10|transaction-idws|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idwsa.com (Malware_Distribution)"; content:"|11|transaction-idwsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idyi.com (Malware_Distribution)"; content:"|10|transaction-idyi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idyin.com (Malware_Distribution)"; content:"|11|transaction-idyin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-idzpl.com (Malware_Distribution)"; content:"|11|transaction-idzpl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaction-online.ru (Malware_Distribution)"; content:"|12|transaction-online|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transactionid-aio.com (Malware_Distribution)"; content:"|11|transactionid-aio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transactionid-mov.com (Malware_Distribution)"; content:"|11|transactionid-mov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unovt2.com (Malware_Infectors)"; content:"|06|unovt2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uppperjp.info (Malware_Distribution)"; content:"|08|uppperjp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vcvsta.com (Malware_Distribution)"; content:"|06|vcvsta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ynwtuu98dr.info (Malware_Distribution)"; content:"|0a|ynwtuu98dr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youdontfkjbaher.ru (Zeus_Zbot_SpyEye)"; content:"|0f|youdontfkjbaher|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4t7uxaxrg8.co.be (Malware_Distribution)"; content:"|0a|4t7uxaxrg8|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 74l8w.co.cc (Malware_Infectors)"; content:"|05|74l8w|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 98dfgr994883798df.com (Zeus_Zbot_SpyEye)"; content:"|11|98dfgr994883798df|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aa2535245.com (Zeus_Zbot_SpyEye)"; content:"|09|aa2535245|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allston-groupsec.cc (Phishing_and_Theft)"; content:"|10|allston-groupsec|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arztpraxis-schaefer.de (Malware_Distribution)"; content:"|13|arztpraxis-schaefer|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atca-inc.com (Phishing_and_Theft)"; content:"|08|atca-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atcanetworks.net (Phishing_and_Theft)"; content:"|0c|atcanetworks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bafihamuxav.com (Spyware)"; content:"|0b|bafihamuxav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bands-groupsvc.com (Phishing_and_Theft)"; content:"|0e|bands-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bands-inc.com (Phishing_and_Theft)"; content:"|09|bands-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bandsgroup-inc.net (Phishing_and_Theft)"; content:"|0e|bandsgroup-inc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bandsgroupnet.cc (Phishing_and_Theft)"; content:"|0d|bandsgroupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bapyrejecak.com (Spyware)"; content:"|0b|bapyrejecak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barribuza.com ()"; content:"|09|barribuza|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beefcake.jino.ru (Zeus_Zbot_SpyEye)"; content:"|08|beefcake|04|jino|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bisyvoqyxymyqi.com (Spyware)"; content:"|0e|bisyvoqyxymyqi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c0re.us (Malware_Infectors)"; content:"|04|c0re|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccfjuyut.bee.pl (Malware_Distribution)"; content:"|08|ccfjuyut|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centrimedicitoscani.it (Zeus_Zbot_SpyEye)"; content:"|13|centrimedicitoscani|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnl-groupsvc.com (Phishing_and_Theft)"; content:"|0c|cnl-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnl-inc.com (Phishing_and_Theft)"; content:"|07|cnl-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnlgroup-inc.cc (Phishing_and_Theft)"; content:"|0c|cnlgroup-inc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnlgroupnet.net (Phishing_and_Theft)"; content:"|0b|cnlgroupnet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosainse.com (Zeus_Zbot_SpyEye)"; content:"|08|cosainse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cruelbox.info (Botnet_C&C)"; content:"|08|cruelbox|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dehozykato.com (Spyware)"; content:"|0a|dehozykato|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup develop-inc.com (Phishing_and_Theft)"; content:"|0b|develop-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup developgroupinc.net (Phishing_and_Theft)"; content:"|0f|developgroupinc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsnextgen.com (Malware_Distribution)"; content:"|09|dsnextgen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evolving-inc.com (Phishing_and_Theft)"; content:"|0c|evolving-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evolvingsysinc.net (Phishing_and_Theft)"; content:"|0e|evolvingsysinc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewloidydytgba.co.be (Malware_Distribution)"; content:"|0d|ewloidydytgba|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup execon.kz (Malware_Infectors)"; content:"|06|execon|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyesecurr327458.net (Zeus_Zbot_SpyEye)"; content:"|0f|eyesecurr327458|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firimasa.net (Malware_Infectors)"; content:"|08|firimasa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fojexojup.com (Spyware)"; content:"|09|fojexojup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foo.com (Malware_Infectors)"; content:"|03|foo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fs8g78f8dduf.com (Malware_Infectors)"; content:"|0c|fs8g78f8dduf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fujoresaw.com (Spyware)"; content:"|09|fujoresaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galleo-inc.com (Phishing_and_Theft)"; content:"|0a|galleo-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galleogroupnet.net (Phishing_and_Theft)"; content:"|0e|galleogroupnet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giant-groupco.net (Phishing_and_Theft)"; content:"|0d|giant-groupco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giant-groupinc.com (Phishing_and_Theft)"; content:"|0e|giant-groupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giant-groupnet.cc (Phishing_and_Theft)"; content:"|0e|giant-groupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giantgroupinc.com (Phishing_and_Theft)"; content:"|0d|giantgroupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guidopietro.com.ar (Spyware)"; content:"|0b|guidopietro|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeofficeteam.com (Spyware)"; content:"|0e|homeofficeteam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup host-groupsvc.net (Phishing_and_Theft)"; content:"|0d|host-groupsvc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostgroup-inc.com (Phishing_and_Theft)"; content:"|0d|hostgroup-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostgroupinc.com (Phishing_and_Theft)"; content:"|0c|hostgroupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostgroupnet.cc (Phishing_and_Theft)"; content:"|0c|hostgroupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ict-groupco.com (Phishing_and_Theft)"; content:"|0b|ict-groupco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ict-groupsvc.net (Phishing_and_Theft)"; content:"|0c|ict-groupsvc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ictgroupinc.com (Phishing_and_Theft)"; content:"|0b|ictgroupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ictgroupnet.cc (Phishing_and_Theft)"; content:"|0b|ictgroupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imperial-groupinc.com (Phishing_and_Theft)"; content:"|11|imperial-groupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imperial-groupsvc.net (Phishing_and_Theft)"; content:"|11|imperial-groupsvc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imperialgroupco.com (Phishing_and_Theft)"; content:"|0f|imperialgroupco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infotech-groupco.net (Phishing_and_Theft)"; content:"|10|infotech-groupco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infotech-groupinc.com (Phishing_and_Theft)"; content:"|11|infotech-groupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infotechgroup-inc.com (Phishing_and_Theft)"; content:"|11|infotechgroup-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inkmoduledso.com (Zeus_Zbot_SpyEye)"; content:"|0c|inkmoduledso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itfcenv.com (Malware_Infectors)"; content:"|07|itfcenv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacumegekij.com (Spyware)"; content:"|0b|jacumegekij|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johunyniv.com (Spyware)"; content:"|09|johunyniv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juqupybocuto.com (Spyware)"; content:"|0c|juqupybocuto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jvc-inc.com (Phishing_and_Theft)"; content:"|07|jvc-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jvcgroupnet.net (Phishing_and_Theft)"; content:"|0b|jvcgroupnet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaliberdapod.net (Zeus_Zbot_SpyEye)"; content:"|0c|kaliberdapod|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lady-gaga-romance.com ()"; content:"|11|lady-gaga-romance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ladygagaromance.net ()"; content:"|0f|ladygagaromance|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ladygagaromance.org ()"; content:"|0f|ladygagaromance|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ladygagaromancefilms.com ()"; content:"|14|ladygagaromancefilms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ladygagaromancetips.com ()"; content:"|13|ladygagaromancetips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastnightphoto.net (Zeus_Zbot_SpyEye)"; content:"|0e|lastnightphoto|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leducivudadyj.com (Spyware)"; content:"|0d|leducivudadyj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lolitasexmovies.com ()"; content:"|0f|lolitasexmovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lopiuy.com (Phishing_and_Theft)"; content:"|06|lopiuy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magnet-groupinc.cc (Phishing_and_Theft)"; content:"|0f|magnet-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marihuqavigyt.com (Spyware)"; content:"|0d|marihuqavigyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mercy-inc.com (Phishing_and_Theft)"; content:"|09|mercy-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mercygroupnet.net (Phishing_and_Theft)"; content:"|0d|mercygroupnet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mexigawarynode.com (Spyware)"; content:"|0e|mexigawarynode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfreewebspase.info (Malware_Infectors)"; content:"|0e|myfreewebspase|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspeezo.ce.ms (Malware_Infectors)"; content:"|08|myspeezo|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup narod-photo.ru (Malware_Infectors)"; content:"|0b|narod-photo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nastymomvids.com ()"; content:"|0c|nastymomvids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neframeofwork.com (Zeus_Zbot_SpyEye)"; content:"|0d|neframeofwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netmarket-inc.com (Phishing_and_Theft)"; content:"|0d|netmarket-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netmarkettech.net (Phishing_and_Theft)"; content:"|0d|netmarkettech|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicynajomypy.com (Spyware)"; content:"|0c|nicynajomypy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nixecynuho.com (Spyware)"; content:"|0a|nixecynuho|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novaris-groupllc.tw (Phishing_and_Theft)"; content:"|10|novaris-groupllc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novaris-grouporg.cc (Phishing_and_Theft)"; content:"|10|novaris-grouporg|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novarisgroupmain.tw (Phishing_and_Theft)"; content:"|10|novarisgroupmain|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nymemuhoseran.com (Spyware)"; content:"|0d|nymemuhoseran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup o18j38.co.cc (Malware_Infectors)"; content:"|06|o18j38|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ofsrtndmcxcsoexq.org (Zeus_Zbot_SpyEye)"; content:"|10|ofsrtndmcxcsoexq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on3news.ru ()"; content:"|07|on3news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on4news.ru ()"; content:"|07|on4news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on5news.com ()"; content:"|07|on5news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on5news.ru ()"; content:"|07|on5news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on6news.com ()"; content:"|07|on6news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on6news.ru ()"; content:"|07|on6news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on7news.ru ()"; content:"|07|on7news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on8news.com ()"; content:"|07|on8news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on8news.ru ()"; content:"|07|on8news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on9news.ru ()"; content:"|07|on9news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online--access.com (Malware_Distribution)"; content:"|0e|online--access|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online--products.com (Malware_Distribution)"; content:"|10|online--products|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-2011-version.com (Malware_Distribution)"; content:"|13|online-2011-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antivirus-protection-reviews.com (Fake_AV)"; content:"|23|online-antivirus-protection-reviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-downloads-2010.com (Malware_Distribution)"; content:"|15|online-downloads-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-football-channel.com (Malware_Distribution)"; content:"|17|online-football-channel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-new-version.com (Malware_Distribution)"; content:"|12|online-new-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-tv-access.com (Malware_Distribution)"; content:"|10|online-tv-access|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-tv-access.net (Malware_Distribution)"; content:"|10|online-tv-access|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-tv-on-pc.com (Malware_Distribution)"; content:"|0f|online-tv-on-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-tv-on-your-pc.com (Malware_Distribution)"; content:"|14|online-tv-on-your-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-vital-records.com (Malware_Distribution)"; content:"|14|online-vital-records|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-web-download.com (Malware_Distribution)"; content:"|13|online-web-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online10flash.com ()"; content:"|0d|online10flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online10news.com ()"; content:"|0c|online10news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online10news.ru ()"; content:"|0c|online10news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online11flash.com ()"; content:"|0d|online11flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perseus-groupfine.tw (Phishing_and_Theft)"; content:"|11|perseus-groupfine|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perseus-groupinc.tw (Phishing_and_Theft)"; content:"|10|perseus-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perseusgroupllc.cc (Phishing_and_Theft)"; content:"|0f|perseusgroupllc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup podojykofogu.com (Spyware)"; content:"|0c|podojykofogu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornopet.com (Malware_Distribution)"; content:"|08|pornopet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pozefybop.com (Spyware)"; content:"|09|pozefybop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protest-west2011.co.cc (Malware_Infectors)"; content:"|10|protest-west2011|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qazomequguca.com (Spyware)"; content:"|0c|qazomequguca|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qozohyhobuci.com (Spyware)"; content:"|0c|qozohyhobuci|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rapekids.com ()"; content:"|08|rapekids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ricogodobekax.com (Spyware)"; content:"|0d|ricogodobekax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sanstag.com (Zeus_Zbot_SpyEye)"; content:"|07|sanstag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savvi-investments.com (Zeus_Zbot_SpyEye)"; content:"|11|savvi-investments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-ant-iv-xp.com (Spyware)"; content:"|11|scanner-ant-iv-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-win-protection.com (Spyware)"; content:"|16|scanner-win-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-win-stuff-protection.com (Spyware)"; content:"|1c|scanner-win-stuff-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantbiteivxp.com (Spyware)"; content:"|12|scannerantbiteivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanneranthillsivxp.com (Spyware)"; content:"|13|scanneranthillsivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantiv.com (Spyware)"; content:"|0c|scannerantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantivirsoft.com (Fake_AV)"; content:"|12|scannerantivirsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantivirsoftdrink.com (Fake_AV)"; content:"|17|scannerantivirsoftdrink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantivirsoftdrinks.com (Fake_AV)"; content:"|18|scannerantivirsoftdrinks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantivirsoftlanding.com (Fake_AV)"; content:"|19|scannerantivirsoftlanding|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantivirsoftrock.com (Fake_AV)"; content:"|16|scannerantivirsoftrock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantivirsoftspot.com (Fake_AV)"; content:"|16|scannerantivirsoftspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerantlionivxp.com (Spyware)"; content:"|12|scannerantlionivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectiondogsfree.com (Spyware)"; content:"|19|scannerprotectiondogsfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionofficesfree.com (Spyware)"; content:"|1c|scannerprotectionofficesfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionwin.com (Spyware)"; content:"|14|scannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerprotectionxp.com (Spyware)"; content:"|13|scannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerwingamesprotection.com (Spyware)"; content:"|19|scannerwingamesprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerwinprotection.com (Spyware)"; content:"|14|scannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serpbe.net (Malware_Infectors)"; content:"|06|serpbe|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexteachervids.com ()"; content:"|0e|sexteachervids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simplychasinasis.com (Zeus_Zbot_SpyEye)"; content:"|10|simplychasinasis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smackbitches.hostding.com (Zeus_Zbot_SpyEye)"; content:"|0c|smackbitches|08|hostding|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solarisgroupinc.com (Phishing_and_Theft)"; content:"|0f|solarisgroupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solarisgroupnet.net (Phishing_and_Theft)"; content:"|0f|solarisgroupnet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup symihyceqemexo.com (Spyware)"; content:"|0e|symihyceqemexo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tomiya.sites.uol.com.br (Malware_Infectors)"; content:"|06|tomiya|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup track.upsclients.org (Zeus_Zbot_SpyEye)"; content:"|05|track|0a|upsclients|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tun4atta.in (Malware_Distribution)"; content:"|08|tun4atta|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultra-gamesdownload.com (Malware_Distribution)"; content:"|13|ultra-gamesdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultragames-download.com (Malware_Distribution)"; content:"|13|ultragames-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimited-downloadcenter.com (Malware_Distribution)"; content:"|18|unlimited-downloadcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimited-mediaaccess.com (Malware_Distribution)"; content:"|15|unlimited-mediaaccess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimitedconsole-games.com (Malware_Distribution)"; content:"|16|unlimitedconsole-games|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimiteddownloadcenter.com (Malware_Distribution)"; content:"|17|unlimiteddownloadcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimiteddownloadnetwork.com (Malware_Distribution)"; content:"|18|unlimiteddownloadnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimiteddownloads-center.com (Malware_Distribution)"; content:"|19|unlimiteddownloads-center|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimitedgame-downloads.com (Malware_Distribution)"; content:"|17|unlimitedgame-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimitedgames-downloads.com (Malware_Distribution)"; content:"|18|unlimitedgames-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimitedmedia-access.com (Malware_Distribution)"; content:"|15|unlimitedmedia-access|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimitedmultimedia-access.com (Malware_Distribution)"; content:"|1a|unlimitedmultimedia-access|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us-legalforms.org (Malware_Distribution)"; content:"|0d|us-legalforms|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us-vital-records.com (Malware_Distribution)"; content:"|10|us-vital-records|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usbirthforms.org (Malware_Distribution)"; content:"|0c|usbirthforms|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usfoodstamps.org (Malware_Distribution)"; content:"|0c|usfoodstamps|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usi-groupinc.net (Phishing_and_Theft)"; content:"|0c|usi-groupinc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usigroup-inc.com (Phishing_and_Theft)"; content:"|0c|usigroup-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usigroupinc.com (Phishing_and_Theft)"; content:"|0b|usigroupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usigroupnet.cc (Phishing_and_Theft)"; content:"|0b|usigroupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usmarriagerecords.info (Malware_Distribution)"; content:"|11|usmarriagerecords|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usvaforms.org (Malware_Distribution)"; content:"|09|usvaforms|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utorant.com (Malware_Distribution)"; content:"|07|utorant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utorint.com (Malware_Distribution)"; content:"|07|utorint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utorrint.com (Malware_Distribution)"; content:"|08|utorrint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uzldzzzeo3.co.be (Malware_Distribution)"; content:"|0a|uzldzzzeo3|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vaforms.org (Malware_Distribution)"; content:"|07|vaforms|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vallesoft.com (Malware_Infectors)"; content:"|09|vallesoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vancouver2010-olympicsonline.com (Malware_Distribution)"; content:"|1c|vancouver2010-olympicsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup victorymarketing.info ()"; content:"|10|victorymarketing|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vital-groupco.cc (Phishing_and_Theft)"; content:"|0d|vital-groupco|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vital-groupco.tw (Phishing_and_Theft)"; content:"|0d|vital-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vital-groupinc.tw (Phishing_and_Theft)"; content:"|0e|vital-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vtbew.info (Malware_Infectors)"; content:"|05|vtbew|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weriloxoro.com (Spyware)"; content:"|0a|weriloxoro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wu2d.com (Malware_Infectors)"; content:"|04|wu2d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xymasehyfi.com (Spyware)"; content:"|0a|xymasehyfi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z9r2.com (Malware_Distribution)"; content:"|04|z9r2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z9r4.com (Malware_Distribution)"; content:"|04|z9r4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zepa6hr6jk.co.be (Malware_Distribution)"; content:"|0a|zepa6hr6jk|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zfdim0u06t.co.be (Malware_Distribution)"; content:"|0a|zfdim0u06t|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoo4arab.net ()"; content:"|08|zoo4arab|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adonion.com (Zeus_Zbot_SpyEye)"; content:"|07|adonion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestbanners2.com (Malware_Distribution)"; content:"|0c|bestbanners2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitigamot.com (Spyware)"; content:"|09|bitigamot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonescanprotectionxp.com (Spyware)"; content:"|14|bonescanprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boundaryscanprotectionxp.com (Spyware)"; content:"|18|boundaryscanprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup card-scanner-win-protection.com (Spyware)"; content:"|1b|card-scanner-win-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cardscannerantiv.com (Spyware)"; content:"|10|cardscannerantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cardscannerprotectionfast.com (Spyware)"; content:"|19|cardscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cardscannerprotectionfree.com (Spyware)"; content:"|19|cardscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cardscannerprotectionwin.com (Spyware)"; content:"|18|cardscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cardscannerprotectionxp.com (Spyware)"; content:"|17|cardscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cardscannerwinprotection.com (Spyware)"; content:"|18|cardscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carehulugy.com (Spyware)"; content:"|0a|carehulugy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapscannerprotectionfast.com (Spyware)"; content:"|1a|cheapscannerprotectionfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapscannerprotectionfree.com (Spyware)"; content:"|1a|cheapscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapscannerprotectionwin.com (Spyware)"; content:"|19|cheapscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colixyniqak.com (Spyware)"; content:"|0b|colixyniqak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupototog.com (Spyware)"; content:"|09|cupototog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daeyoolife.com (Malware_Distribution)"; content:"|0a|daeyoolife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doyle.boo.jp (Malware_Distribution)"; content:"|05|doyle|03|boo|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dunysinykesiti.com (Spyware)"; content:"|0e|dunysinykesiti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duvexofejox.com (Spyware)"; content:"|0b|duvexofejox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dyxavehovi.com (Spyware)"; content:"|0a|dyxavehovi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-ora.gr (Malware_Infectors)"; content:"|05|e-ora|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fahibyfihovawe.com (Spyware)"; content:"|0e|fahibyfihovawe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fopykybybydy.com (Spyware)"; content:"|0c|fopykybybydy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funnysignage.com (Malware_Distribution)"; content:"|0c|funnysignage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyvamomadebet.com (Spyware)"; content:"|0d|fyvamomadebet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gacemugutil.com (Spyware)"; content:"|0b|gacemugutil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galahikeve.com (Spyware)"; content:"|0a|galahikeve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gefexepoj.com (Spyware)"; content:"|09|gefexepoj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gesegoziji.com (Spyware)"; content:"|0a|gesegoziji|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getsomepornsnow.com (Fake_AV)"; content:"|0f|getsomepornsnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gokiqoliroc.com (Spyware)"; content:"|0b|gokiqoliroc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodprivacy.co.kr (Malware_Distribution)"; content:"|0b|goodprivacy|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guidetoolbar3c.com (Spyware)"; content:"|0e|guidetoolbar3c|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gyxanobevywog.com (Spyware)"; content:"|0d|gyxanobevywog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoqavazikececo.com (Spyware)"; content:"|0e|hoqavazikececo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilikeclick.com (Malware_Distribution)"; content:"|0a|ilikeclick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interich.com (Malware_Distribution)"; content:"|08|interich|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jibiravebapof.com (Spyware)"; content:"|0d|jibiravebapof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jididoraw.com (Spyware)"; content:"|09|jididoraw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jintanapatonghotel.co.th (Malware_Distribution)"; content:"|12|jintanapatonghotel|02|co|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jisoqamyse.com (Spyware)"; content:"|0a|jisoqamyse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jujiwyqakexyq.com (Spyware)"; content:"|0d|jujiwyqakexyq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kayne.mireene.com (Malware_Distribution)"; content:"|05|kayne|07|mireene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kecewepin.com (Spyware)"; content:"|09|kecewepin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lonekucog.com (Spyware)"; content:"|09|lonekucog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macbooksecurity.com (Spyware)"; content:"|0f|macbooksecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maweqigot.com (Spyware)"; content:"|09|maweqigot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoftmsns.com (Spyware)"; content:"|0d|microsoftmsns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namemaster46.net (Fake_AV)"; content:"|0c|namemaster46|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namemaster47.net (Fake_AV)"; content:"|0c|namemaster47|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noc.su (Malware_Distribution)"; content:"|03|noc|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paperquillingart.com (Malware_Distribution)"; content:"|10|paperquillingart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pezugejomimoz.com (Spyware)"; content:"|0d|pezugejomimoz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phangnga-rafting.com (Malware_Distribution)"; content:"|10|phangnga-rafting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pogorecywihira.com (Spyware)"; content:"|0e|pogorecywihira|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portablescannerprotectionfree.com (Spyware)"; content:"|1d|portablescannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portablescannerprotectionwin.com (Spyware)"; content:"|1c|portablescannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portablescannerprotectionxp.com (Spyware)"; content:"|1b|portablescannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portablescannerwinprotection.com (Spyware)"; content:"|1c|portablescannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portablescannerxpprotection.com (Spyware)"; content:"|1b|portablescannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portscannerprotectionfree.com (Spyware)"; content:"|19|portscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portscannerprotectionwin.com (Spyware)"; content:"|18|portscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portscannerprotectionxp.com (Spyware)"; content:"|17|portscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portscannerwinprotection.com (Spyware)"; content:"|18|portscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portscannerxpprotection.com (Spyware)"; content:"|17|portscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pozemoxehyt.com (Spyware)"; content:"|0b|pozemoxehyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pranictechfi.co.cc (Fake_AV)"; content:"|0c|pranictechfi|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup printerscannerprotectionfree.com (Spyware)"; content:"|1c|printerscannerprotectionfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup printerscannerprotectionwin.com (Spyware)"; content:"|1b|printerscannerprotectionwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup printerscannerprotectionxp.com (Spyware)"; content:"|1a|printerscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup printerscannerwinprotection.com (Spyware)"; content:"|1b|printerscannerwinprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup printerscannerxpprotection.com (Spyware)"; content:"|1a|printerscannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup progressivescanprotectionsoft.com (Spyware)"; content:"|1d|progressivescanprotectionsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup progressivescanprotectionxp.com (Spyware)"; content:"|1b|progressivescanprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup progressivescansoftprotection.com (Spyware)"; content:"|1d|progressivescansoftprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup progressivescansoftprotectionxp.com (Spyware)"; content:"|1f|progressivescansoftprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectaidsvirusxpnow.com (Fake_AV)"; content:"|15|protectaidsvirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectbootvirusxpnow.com (Fake_AV)"; content:"|15|protectbootvirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectcoldvirusxpnow.com (Fake_AV)"; content:"|15|protectcoldvirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectdefinevirusxpnow.com (Fake_AV)"; content:"|17|protectdefinevirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectemailvirusxpnow.com (Fake_AV)"; content:"|16|protectemailvirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectfreexpnow.com (Spyware)"; content:"|10|protectfreexpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectinstantwinscanner.com (Spyware)"; content:"|18|protectinstantwinscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-ant-farm-iv-scan-xp.com (Spyware)"; content:"|1e|protection-ant-farm-iv-scan-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-ant-iv-scan-xp.com (Spyware)"; content:"|19|protection-ant-iv-scan-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-xp-scanner.com (Spyware)"; content:"|15|protection-xp-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionadamantiv.com (Spyware)"; content:"|13|protectionadamantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionadamantivscanxp.com (Spyware)"; content:"|19|protectionadamantivscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionantcolonyivscanxp.com (Spyware)"; content:"|1b|protectionantcolonyivscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionantfarmivscanxp.com (Spyware)"; content:"|19|protectionantfarmivscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionanthilliv.com (Spyware)"; content:"|13|protectionanthilliv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionantivscanxp.com (Spyware)"; content:"|15|protectionantivscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionboostxpscanner.com (Spyware)"; content:"|18|protectionboostxpscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectioninstallxpscanner.com (Spyware)"; content:"|1a|protectioninstallxpscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionmicrosoftxpscanner.com (Spyware)"; content:"|1c|protectionmicrosoftxpscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsafexpscanner.com (Spyware)"; content:"|17|protectionsafexpscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionscnasoft.com (Spyware)"; content:"|12|protectionscnasoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionscnasoftdrink.com (Spyware)"; content:"|17|protectionscnasoftdrink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionscnasoftdrinks.com (Spyware)"; content:"|18|protectionscnasoftdrinks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionscnasoftlanding.com (Spyware)"; content:"|19|protectionscnasoftlanding|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionscnasoftrock.com (Spyware)"; content:"|16|protectionscnasoftrock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscanner.com (Spyware)"; content:"|15|protectionsoftscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscanneralbum.com (Spyware)"; content:"|1a|protectionsoftscanneralbum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannerdefinition.com (Spyware)"; content:"|1f|protectionsoftscannerdefinition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannerdriver.com (Spyware)"; content:"|1b|protectionsoftscannerdriver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannerdrivers.com (Spyware)"; content:"|1c|protectionsoftscannerdrivers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannerfeatures.com (Spyware)"; content:"|1d|protectionsoftscannerfeatures|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannerglass.com (Spyware)"; content:"|1a|protectionsoftscannerglass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannerguide.com (Spyware)"; content:"|1a|protectionsoftscannerguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannerhardware.com (Spyware)"; content:"|1d|protectionsoftscannerhardware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannermaintenance.com (Spyware)"; content:"|20|protectionsoftscannermaintenance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannermaster.com (Spyware)"; content:"|1b|protectionsoftscannermaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsoftscannermodels.com (Spyware)"; content:"|1b|protectionsoftscannermodels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectiontunexpscanner.com (Spyware)"; content:"|17|protectiontunexpscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionwindowsxpscanner.com (Spyware)"; content:"|1a|protectionwindowsxpscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpdesktopscanner.com (Spyware)"; content:"|1a|protectionxpdesktopscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscanner.com (Spyware)"; content:"|13|protectionxpscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscanneralbum.com (Spyware)"; content:"|18|protectionxpscanneralbum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerdefinition.com (Spyware)"; content:"|1d|protectionxpscannerdefinition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerdriver.com (Spyware)"; content:"|19|protectionxpscannerdriver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerdrivers.com (Spyware)"; content:"|1a|protectionxpscannerdrivers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerfeatures.com (Spyware)"; content:"|1b|protectionxpscannerfeatures|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerglass.com (Spyware)"; content:"|18|protectionxpscannerglass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerguide.com (Spyware)"; content:"|18|protectionxpscannerguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerhardware.com (Spyware)"; content:"|1b|protectionxpscannerhardware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerinterface.com (Spyware)"; content:"|1c|protectionxpscannerinterface|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannermaintenance.com (Spyware)"; content:"|1e|protectionxpscannermaintenance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannermaster.com (Spyware)"; content:"|19|protectionxpscannermaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannermodels.com (Spyware)"; content:"|19|protectionxpscannermodels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerprofile.com (Spyware)"; content:"|1a|protectionxpscannerprofile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerrepair.com (Spyware)"; content:"|19|protectionxpscannerrepair|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannerreviews.com (Spyware)"; content:"|1a|protectionxpscannerreviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannersolutions.com (Spyware)"; content:"|1c|protectionxpscannersolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannersupplies.com (Spyware)"; content:"|1b|protectionxpscannersupplies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionxpscannertips.com (Spyware)"; content:"|17|protectionxpscannertips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectmobilevirusxpnow.com (Fake_AV)"; content:"|17|protectmobilevirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectrarevirusxpnow.com (Fake_AV)"; content:"|15|protectrarevirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectremovevirusxpnow.com (Fake_AV)"; content:"|17|protectremovevirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectstomachvirusxpnow.com (Fake_AV)"; content:"|18|protectstomachvirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectvirusboostxpnow.com (Fake_AV)"; content:"|16|protectvirusboostxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectvirusinstallxpnow.com (Fake_AV)"; content:"|18|protectvirusinstallxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectvirusmicrosoftxpnow.com (Fake_AV)"; content:"|1a|protectvirusmicrosoftxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectvirustunexpnow.com (Fake_AV)"; content:"|15|protectvirustunexpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectviruswindowsxpnow.com (Fake_AV)"; content:"|18|protectviruswindowsxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectvirusxpdesktopnow.com (Fake_AV)"; content:"|18|protectvirusxpdesktopnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectvirusxpnow.com (Fake_AV)"; content:"|11|protectvirusxpnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup requzunigiver.com (Spyware)"; content:"|0d|requzunigiver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roromavice.com (Spyware)"; content:"|0a|roromavice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rucyfozod.com (Spyware)"; content:"|09|rucyfozod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryjybytokew.com (Spyware)"; content:"|0b|ryjybytokew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saqutuhopyqej.com (Spyware)"; content:"|0d|saqutuhopyqej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sasoxizyriw.com (Spyware)"; content:"|0b|sasoxizyriw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scandolcenerantv.com (Spyware)"; content:"|10|scandolcenerantv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfiumenerantv.com (Spyware)"; content:"|10|scanfiumenerantv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanforestanerantv.com (Spyware)"; content:"|12|scanforestanerantv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreccianerantv.com (Spyware)"; content:"|12|scanfreccianerantv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeadamantivxp.com (Spyware)"; content:"|13|scanfreeadamantivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeantbiteivxp.com (Spyware)"; content:"|13|scanfreeantbiteivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeantcolonyivxp.com (Spyware)"; content:"|15|scanfreeantcolonyivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeantfarmivxp.com (Spyware)"; content:"|13|scanfreeantfarmivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeantfarmsivxp.com (Spyware)"; content:"|14|scanfreeantfarmsivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeanthillivxp.com (Spyware)"; content:"|13|scanfreeanthillivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeanthillsivxp.com (Spyware)"; content:"|14|scanfreeanthillsivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeantivxp.com (Spyware)"; content:"|0f|scanfreeantivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeantlionivxp.com (Spyware)"; content:"|13|scanfreeantlionivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeanttaskivxp.com (Spyware)"; content:"|13|scanfreeanttaskivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeargentineantivxp.com (Spyware)"; content:"|18|scanfreeargentineantivxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreexbreadpantiv.com (Spyware)"; content:"|14|scanfreexbreadpantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreexcakepantiv.com (Spyware)"; content:"|13|scanfreexcakepantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreexcookingpantiv.com (Spyware)"; content:"|16|scanfreexcookingpantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreexdrainpantiv.com (Spyware)"; content:"|14|scanfreexdrainpantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreexgreekpantiv.com (Spyware)"; content:"|14|scanfreexgreekpantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreexpantiv.com (Spyware)"; content:"|0f|scanfreexpantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-ant-farm-iv-xp.com (Spyware)"; content:"|16|scanner-ant-farm-iv-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerwinstuffprotection.com (Spyware)"; content:"|19|scannerwinstuffprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerxpdesktopprotection.com (Spyware)"; content:"|1a|scannerxpdesktopprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerxpdriversprotection.com (Spyware)"; content:"|1a|scannerxpdriversprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerxpinstallationprotection.com (Spyware)"; content:"|1f|scannerxpinstallationprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerxppracticesprotection.com (Spyware)"; content:"|1c|scannerxppracticesprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerxpprotection.com (Spyware)"; content:"|13|scannerxpprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerxprepairprotection.com (Spyware)"; content:"|19|scannerxprepairprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerxpstyleprotection.com (Spyware)"; content:"|18|scannerxpstyleprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerxpthemesprotection.com (Spyware)"; content:"|19|scannerxpthemesprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectiondogssoft.com (Spyware)"; content:"|16|scanprotectiondogssoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionexpertsxp.com (Spyware)"; content:"|17|scanprotectionexpertsxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionplussoft.com (Spyware)"; content:"|16|scanprotectionplussoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionplusxp.com (Spyware)"; content:"|14|scanprotectionplusxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionprinciplessoft.com (Spyware)"; content:"|1c|scanprotectionprinciplessoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionprinciplesxp.com (Spyware)"; content:"|1a|scanprotectionprinciplesxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionprofessionalssoft.com (Spyware)"; content:"|1f|scanprotectionprofessionalssoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionprofessionalsxp.com (Spyware)"; content:"|1d|scanprotectionprofessionalsxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionsolutionssoft.com (Spyware)"; content:"|1b|scanprotectionsolutionssoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanprotectionspecialistsoft.com (Spyware)"; content:"|1c|scanprotectionspecialistsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sefigecusotemi.com (Spyware)"; content:"|0e|sefigecusotemi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sm00501.com (Malware_Distribution)"; content:"|07|sm00501|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suzyvupukunepu.com (Spyware)"; content:"|0e|suzyvupukunepu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teklamatik.com.br (Malware_Distribution)"; content:"|0a|teklamatik|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titagetudo.com (Spyware)"; content:"|0a|titagetudo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tufykyjoki.com (Spyware)"; content:"|0a|tufykyjoki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuhyvejawat.com (Spyware)"; content:"|0b|tuhyvejawat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tupasupihel.com (Spyware)"; content:"|0b|tupasupihel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tykisarokuxesy.com (Spyware)"; content:"|0e|tykisarokuxesy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valanofajo.com (Spyware)"; content:"|0a|valanofajo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vaporenegiqi.com (Spyware)"; content:"|0c|vaporenegiqi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wokikywalonez.com (Spyware)"; content:"|0d|wokikywalonez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wokykevob.com (Spyware)"; content:"|09|wokykevob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wuhefifyfaqexi.com (Spyware)"; content:"|0e|wuhefifyfaqexi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xifikyziqog.com (Spyware)"; content:"|0b|xifikyziqog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zagucapomup.com (Spyware)"; content:"|0b|zagucapomup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zelabuhib.com (Spyware)"; content:"|09|zelabuhib|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zogovuwex.com (Spyware)"; content:"|09|zogovuwex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zopyralor.com (Spyware)"; content:"|09|zopyralor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zywufoqovy.com (Spyware)"; content:"|0a|zywufoqovy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup workuscnm.cafe24.com (Malware_Distribution)"; content:"|09|workuscnm|06|cafe24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup askei.kiev.ua (Malware_Infectors)"; content:"|05|askei|04|kiev|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reycross.com (Malware_Distribution)"; content:"|08|reycross|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjbecomeone.com (Malware_Distribution)"; content:"|0b|sjbecomeone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skinizna.sk (Malware_Infectors)"; content:"|08|skinizna|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sofeqadro.ru (Malware_Distribution)"; content:"|09|sofeqadro|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziodio.co.kr (Malware_Distribution)"; content:"|06|ziodio|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1glacisgroup-llc.net (Phishing_and_Theft)"; content:"|10|1glacisgroup-llc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2n6h.co.cc (Malware_Distribution)"; content:"|04|2n6h|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3atlanta-uk.com (Phishing_and_Theft)"; content:"|0b|3atlanta-uk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5dali-style.com (Phishing_and_Theft)"; content:"|0b|5dali-style|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7lrkvy.co.cc (Malware_Distribution)"; content:"|06|7lrkvy|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 92cfa9e0.b8r4.org (Malware_Distribution)"; content:"|08|92cfa9e0|04|b8r4|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaaholic.com (Malware_Distribution)"; content:"|08|aaaholic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abodefllash.co.cc (Malware_Distribution)"; content:"|0b|abodefllash|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abodeplugin.co.cc (Malware_Distribution)"; content:"|0b|abodeplugin|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobecodec-01.co.tv (Malware_Infectors)"; content:"|0d|adobecodec-01|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobecodec-02.co.tv (Malware_Infectors)"; content:"|0d|adobecodec-02|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup angielskidlarodzicow.pl (Malware_Distribution)"; content:"|14|angielskidlarodzicow|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aprotest-avi2011.co.cc (Malware_Distribution)"; content:"|10|aprotest-avi2011|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asdaqr15.com (Zeus_Zbot_SpyEye)"; content:"|08|asdaqr15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atlanta-ltd-uk.net (Phishing_and_Theft)"; content:"|0e|atlanta-ltd-uk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atlantaltd-uk.cc (Phishing_and_Theft)"; content:"|0d|atlantaltd-uk|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avgenup.in (Malware_Distribution)"; content:"|07|avgenup|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blitznet-groupinc.cc (Phishing_and_Theft)"; content:"|11|blitznet-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bnhapeirud.co.cc (Malware_Distribution)"; content:"|0a|bnhapeirud|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bqtuhwhm.ce.ms (Spyware)"; content:"|08|bqtuhwhm|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chirnsideandren.cx.cc (Malware_Distribution)"; content:"|0f|chirnsideandren|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickjacksonville.org (Malware_Distribution)"; content:"|11|clickjacksonville|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dalistyle-group.cc (Phishing_and_Theft)"; content:"|0f|dalistyle-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-beaxz.in (Malware_Distribution)"; content:"|0e|defender-beaxz|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-fdjez.in (Malware_Distribution)"; content:"|0e|defender-fdjez|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-nessc.in (Malware_Distribution)"; content:"|0e|defender-nessc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derwoode-group.com (Phishing_and_Theft)"; content:"|0e|derwoode-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derwoode-group.net (Phishing_and_Theft)"; content:"|0e|derwoode-group|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digibeetlesop.ru (Zeus_Zbot_SpyEye)"; content:"|0d|digibeetlesop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup docmoo.ce.ms (Malware_Distribution)"; content:"|06|docmoo|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecvcallise.co.cc (Malware_Distribution)"; content:"|0a|ecvcallise|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup essclean-online.com (Malware_Distribution)"; content:"|0f|essclean-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esscleaner.com (Malware_Distribution)"; content:"|0a|esscleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezzo.ce.ms (Malware_Distribution)"; content:"|04|ezzo|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscandn-pc.tk (Malware_Distribution)"; content:"|0d|fastscandn-pc|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flash-02.co.tv (Malware_Infectors)"; content:"|08|flash-02|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashplugins.net (Malware_Distribution)"; content:"|0c|flashplugins|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fmoo.ce.ms (Malware_Distribution)"; content:"|04|fmoo|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeopenscanerpo.in (Malware_Distribution)"; content:"|10|freeopenscanerpo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frozyn.info (Malware_Infectors)"; content:"|06|frozyn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gb-offers.com (Phishing_and_Theft)"; content:"|09|gb-offers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geceeroe.ce.ms (Malware_Distribution)"; content:"|08|geceeroe|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geelh.ce.ms (Malware_Distribution)"; content:"|05|geelh|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grandao2010.qipim.ru (Malware_Distribution)"; content:"|0b|grandao2010|05|qipim|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwgwrhtetretnt.com (Malware_Distribution)"; content:"|0e|gwgwrhtetretnt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gxdowzsz.ce.ms (Spyware)"; content:"|08|gxdowzsz|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helpmedownload.com (Malware_Distribution)"; content:"|0e|helpmedownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hkjhcgaidiiii.com (Malware_Distribution)"; content:"|0d|hkjhcgaidiiii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hnifuzof.cn (Malware_Distribution)"; content:"|08|hnifuzof|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homerev-sys.com ()"; content:"|0b|homerev-sys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homerev2-sys.com ()"; content:"|0c|homerev2-sys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot-mp3download.com (Malware_Distribution)"; content:"|0f|hot-mp3download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotmp3-download.com (Malware_Distribution)"; content:"|0f|hotmp3-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsghyturrerefg.com (Malware_Distribution)"; content:"|0e|hsghyturrerefg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsovolih.cn (Malware_Distribution)"; content:"|08|hsovolih|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hypnosis-guide-pro.com (Malware_Distribution)"; content:"|12|hypnosis-guide-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i-tvdish.com (Malware_Distribution)"; content:"|08|i-tvdish|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idownload-istore-music.com (Malware_Distribution)"; content:"|16|idownload-istore-music|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idownload-istore.com (Malware_Distribution)"; content:"|10|idownload-istore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idownload-store-music.com (Malware_Distribution)"; content:"|15|idownload-store-music|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idownload-tunesmusic.com (Malware_Distribution)"; content:"|14|idownload-tunesmusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup image-editor-download.com (Malware_Distribution)"; content:"|15|image-editor-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup immigration-in-us.org (Malware_Distribution)"; content:"|11|immigration-in-us|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imusic-download.com (Malware_Distribution)"; content:"|0f|imusic-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imusic-store-downloads.com (Malware_Distribution)"; content:"|16|imusic-store-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infofraud.net (Malware_Infectors)"; content:"|09|infofraud|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup it-amira.net (Phishing_and_Theft)"; content:"|08|it-amira|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup it-serviceltd.be (Phishing_and_Theft)"; content:"|0d|it-serviceltd|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itamira-de.com (Phishing_and_Theft)"; content:"|0a|itamira-de|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itserv-de.co (Phishing_and_Theft)"; content:"|09|itserv-de|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jahn-siegen.de (Malware_Distribution)"; content:"|0b|jahn-siegen|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kade-group.com (Phishing_and_Theft)"; content:"|0a|kade-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ketchersode.ce.ms (Malware_Distribution)"; content:"|0b|ketchersode|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lasfotosmasnice.com (Malware_Distribution)"; content:"|0f|lasfotosmasnice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letbeservice.ru (Malware_Distribution)"; content:"|0c|letbeservice|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livesports-network.com (Malware_Distribution)"; content:"|12|livesports-network|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livestreamdirect.com (Malware_Distribution)"; content:"|10|livestreamdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macwinsoft.net (SEO_Fraud)"; content:"|0a|macwinsoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup markizac.com (Zeus_Zbot_SpyEye)"; content:"|08|markizac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masterart-group.com (Phishing_and_Theft)"; content:"|0f|masterart-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcmonnes.ce.ms (Malware_Distribution)"; content:"|08|mcmonnes|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medi-fix.com (Malware_Distribution)"; content:"|08|medi-fix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mendryltd.com (Phishing_and_Theft)"; content:"|09|mendryltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metbizz.com (Malware_Distribution)"; content:"|07|metbizz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miliardov.com (Malware_Distribution)"; content:"|09|miliardov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnuyspe.co.be (Malware_Distribution)"; content:"|07|mnuyspe|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobiledownloads-pro.com (Malware_Distribution)"; content:"|13|mobiledownloads-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moonsgootlasynch.co.cc (Malware_Distribution)"; content:"|10|moonsgootlasynch|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movie-downloads-direct.com (Malware_Distribution)"; content:"|16|movie-downloads-direct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movie-downloadsnow.com (Malware_Distribution)"; content:"|12|movie-downloadsnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviedownloads-pro.com (Malware_Distribution)"; content:"|12|moviedownloads-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3-depot.com (Malware_Distribution)"; content:"|09|mp3-depot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3-downloadingnet.com (Malware_Distribution)"; content:"|12|mp3-downloadingnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3-share.us (Malware_Distribution)"; content:"|09|mp3-share|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3download-net.com (Malware_Distribution)"; content:"|0f|mp3download-net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3downloadhq.com (Malware_Distribution)"; content:"|0d|mp3downloadhq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3downloading-net.com (Malware_Distribution)"; content:"|12|mp3downloading-net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3helpdesk.com (Malware_Distribution)"; content:"|0b|mp3helpdesk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3sectionentitled.com (Malware_Distribution)"; content:"|12|mp3sectionentitled|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mscser.ru (Malware_Distribution)"; content:"|06|mscser|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mstoolkit.com (Malware_Distribution)"; content:"|09|mstoolkit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup music-d0wnload-center.com (Malware_Distribution)"; content:"|15|music-d0wnload-center|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup music-folia.com (Malware_Distribution)"; content:"|0b|music-folia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup music-idownloads.com (Malware_Distribution)"; content:"|10|music-idownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup music-istore-downloads.com (Malware_Distribution)"; content:"|16|music-istore-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup music-moviesnetwork.com (Malware_Distribution)"; content:"|13|music-moviesnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup music-new-downloads.com (Malware_Distribution)"; content:"|13|music-new-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfghavs.com (Malware_Distribution)"; content:"|08|myfghavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namebuypicture.cn (Malware_Distribution)"; content:"|0e|namebuypicture|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup natspot-serve.com (Malware_Distribution)"; content:"|0d|natspot-serve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newantivirusdownloads.com (Fake_AV)"; content:"|15|newantivirusdownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz10news.com ()"; content:"|0c|newbiz10news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz1cash.com ()"; content:"|0b|newbiz1cash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz1news.com ()"; content:"|0b|newbiz1news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz2news.com ()"; content:"|0b|newbiz2news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz3news.com ()"; content:"|0b|newbiz3news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz4news.com ()"; content:"|0b|newbiz4news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz5news.com ()"; content:"|0b|newbiz5news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz6news.com ()"; content:"|0b|newbiz6news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz7news.com ()"; content:"|0b|newbiz7news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz8news.com ()"; content:"|0b|newbiz8news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbiz9news.com ()"; content:"|0b|newbiz9news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newest-version-download.com (Malware_Distribution)"; content:"|17|newest-version-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash10news.com ()"; content:"|0e|newflash10news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup npeyugux.cn (Malware_Distribution)"; content:"|08|npeyugux|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officesuite-download.com (Malware_Distribution)"; content:"|14|officesuite-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palazziogt.ru (Malware_Distribution)"; content:"|0a|palazziogt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parlen-group-usa.com (Phishing_and_Theft)"; content:"|10|parlen-group-usa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parlen-groupllc.com (Phishing_and_Theft)"; content:"|0f|parlen-groupllc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parlengroupllc.net (Phishing_and_Theft)"; content:"|0e|parlengroupllc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phonezero.com.br (Malware_Distribution)"; content:"|09|phonezero|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectantivscanfree1.com (Malware_Distribution)"; content:"|15|protectantivscanfree1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quad-groupuk.cc (Phishing_and_Theft)"; content:"|0c|quad-groupuk|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quad-it-group.com (Phishing_and_Theft)"; content:"|0d|quad-it-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quinta-groupus.com (Phishing_and_Theft)"; content:"|0e|quinta-groupus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quinta-llc.net (Phishing_and_Theft)"; content:"|0a|quinta-llc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quintagroup.cc (Phishing_and_Theft)"; content:"|0b|quintagroup|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-tab.com (Malware_Distribution)"; content:"|05|r-tab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rajeshwariinfosys.com (Malware_Distribution)"; content:"|11|rajeshwariinfosys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raucherhimmel.de (Zeus_Zbot_SpyEye)"; content:"|0d|raucherhimmel|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rbomce.com (Malware_Distribution)"; content:"|06|rbomce|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rextechinnovation.com (Phishing_and_Theft)"; content:"|11|rextechinnovation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rextechltd-us.com (Phishing_and_Theft)"; content:"|0d|rextechltd-us|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rextechltd.cc (Phishing_and_Theft)"; content:"|0a|rextechltd|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sadone.ce.ms (Malware_Distribution)"; content:"|06|sadone|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup schwendonger.ce.ms (Malware_Distribution)"; content:"|0c|schwendonger|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchalphabet.org (Malware_Distribution)"; content:"|0e|searchalphabet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchant.org (Malware_Distribution)"; content:"|09|searchant|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchatom.org (Malware_Distribution)"; content:"|0a|searchatom|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchbegan.org (Malware_Distribution)"; content:"|0b|searchbegan|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup special-art-ltd.com (Phishing_and_Theft)"; content:"|0f|special-art-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup special-art-uk.cc (Phishing_and_Theft)"; content:"|0e|special-art-uk|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sroxcwoa.ce.ms (Spyware)"; content:"|08|sroxcwoa|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stillmate.co.cc (Malware_Distribution)"; content:"|09|stillmate|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subdom25.com (Malware_Distribution)"; content:"|08|subdom25|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sublime-ltd.net (Phishing_and_Theft)"; content:"|0b|sublime-ltd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup targetmarketgroup-llc.cc (Phishing_and_Theft)"; content:"|15|targetmarketgroup-llc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taskmalbbunde.co.cc (Malware_Distribution)"; content:"|0d|taskmalbbunde|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestscannerdha.l2x.eu (Malware_Distribution)"; content:"|11|thebestscannerdha|03|l2x|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tingdjibmar.ce.ms (Malware_Distribution)"; content:"|0b|tingdjibmar|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic-4webmaster.com (Zeus_Zbot_SpyEye)"; content:"|12|traffic-4webmaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyodi.com (Malware_Distribution)"; content:"|05|tyodi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vci01.appbundler.net (Malware_Distribution)"; content:"|05|vci01|0a|appbundler|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videocrazy.cx.cc (Malware_Distribution)"; content:"|0a|videocrazy|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusprotection24.com (Fake_AV)"; content:"|11|virusprotection24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vnsproject-de.cc (Phishing_and_Theft)"; content:"|0d|vnsproject-de|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vortex-llc-uk.net (Phishing_and_Theft)"; content:"|0d|vortex-llc-uk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vortexllc-uk.com (Phishing_and_Theft)"; content:"|0c|vortexllc-uk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wayuvaga111.vv.cc (Malware_Distribution)"; content:"|0b|wayuvaga111|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-fotogallery.be (Malware_Distribution)"; content:"|0f|web-fotogallery|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wexct.info (Malware_Distribution)"; content:"|05|wexct|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woedmonn.ce.ms (Malware_Distribution)"; content:"|08|woedmonn|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worksappmedia.in (Malware_Distribution)"; content:"|0d|worksappmedia|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xbx.tw (Malware_Distribution)"; content:"|03|xbx|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhyjl.cn ()"; content:"|05|xhyjl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmycelebs.co.cc (Malware_Distribution)"; content:"|09|xmycelebs|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahbesvyt.com (Malware_Infectors)"; content:"|09|yahbesvyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youtubeonline.net (Malware_Distribution)"; content:"|0d|youtubeonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booblegum9.co.cc (Malware_Distribution)"; content:"|0a|booblegum9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkingbuziness.com (Malware_Infectors)"; content:"|0f|linkingbuziness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup specialtech.com.co (Malware_Infectors)"; content:"|0b|specialtech|03|com|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lancasterautoelectric.com (Botnet_C&C)"; content:"|15|lancasterautoelectric|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0c7k29.co.cc (Malware_Infectors)"; content:"|06|0c7k29|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup active-scan.com (Spyware)"; content:"|0b|active-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup al1-xscript0s.com (Malware_Infectors)"; content:"|0d|al1-xscript0s|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alfacleanwin.com (Spyware)"; content:"|0c|alfacleanwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alghazitractors.com (Malware_Distribution)"; content:"|0f|alghazitractors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup askredpoleq.com ()"; content:"|0b|askredpoleq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assbrotherhood.ru (Malware_Distribution)"; content:"|0e|assbrotherhood|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b4lry1.co.cc (Malware_Infectors)"; content:"|06|b4lry1|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestaudia7.com ()"; content:"|0a|bestaudia7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bharathiyagurukulam.com (Malware_Distribution)"; content:"|13|bharathiyagurukulam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmetalvs.com (Spyware)"; content:"|08|bmetalvs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bnavs.com (Spyware)"; content:"|05|bnavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bnavsgroup.com (Spyware)"; content:"|0a|bnavsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bnavsonline.com (Spyware)"; content:"|0b|bnavsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bnavsxp.com (Spyware)"; content:"|07|bnavsxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bo8l1a.co.cc (Malware_Infectors)"; content:"|06|bo8l1a|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boards.soapcentral.com (Malware_Infectors)"; content:"|06|boards|0b|soapcentral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buqajoqunely.com (Spyware)"; content:"|0c|buqajoqunely|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccjava-l0ad.com (Malware_Infectors)"; content:"|0b|ccjava-l0ad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cibabewytyl.com (Spyware)"; content:"|0b|cibabewytyl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cigivasepuxy.com (Malware_Distribution)"; content:"|0c|cigivasepuxy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciquqamod.com (Spyware)"; content:"|09|ciquqamod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cizubejiwoma.com (Spyware)"; content:"|0c|cizubejiwoma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cknovt.com (Malware_Infectors)"; content:"|06|cknovt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanscanpro.com (Spyware)"; content:"|0c|cleanscanpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleartraf.ru ()"; content:"|09|cleartraf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clnovt.com (Malware_Infectors)"; content:"|06|clnovt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coldhardcash4us.com (Zeus_Zbot_SpyEye)"; content:"|0f|coldhardcash4us|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup complete-art-group-ltd.com (Phishing_and_Theft)"; content:"|16|complete-art-group-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup complete-art-uk.net (Phishing_and_Theft)"; content:"|0f|complete-art-uk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup condor-llc-uk.net (Phishing_and_Theft)"; content:"|0d|condor-llc-uk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup condorllc-uk.com (Phishing_and_Theft)"; content:"|0c|condorllc-uk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crackrapidshare.net (Malware_Infectors)"; content:"|0f|crackrapidshare|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crackserialkeys.net (Malware_Infectors)"; content:"|0f|crackserialkeys|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crackshare.net (Malware_Infectors)"; content:"|0a|crackshare|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cwnovt.com (Malware_Infectors)"; content:"|06|cwnovt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup damskezimnibundy.cz (Malware_Distribution)"; content:"|10|damskezimnibundy|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup de-kadegroup.cc (Phishing_and_Theft)"; content:"|0c|de-kadegroup|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-sdvup.in (Malware_Distribution)"; content:"|0e|defender-sdvup|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-tmp.in (Spyware)"; content:"|0c|defender-tmp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup depotex.com (Botnet_C&C)"; content:"|07|depotex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derlsplay.com (Botnet_C&C)"; content:"|09|derlsplay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dirnaster.com (Botnet_C&C)"; content:"|09|dirnaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diverthigh.com (Botnet_C&C)"; content:"|0a|diverthigh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup docrealtor.com (Botnet_C&C)"; content:"|0a|docrealtor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup docweds.com (Botnet_C&C)"; content:"|07|docweds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evelismag.info (Zeus_Zbot_SpyEye)"; content:"|09|evelismag|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewa.kz (Malware_Distribution)"; content:"|03|ewa|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fabviolu.com (Botnet_C&C)"; content:"|08|fabviolu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fajomowiqy.com (Spyware)"; content:"|0a|fajomowiqy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup famopaips.com (Botnet_C&C)"; content:"|09|famopaips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fapyrypumumuva.com (Spyware)"; content:"|0e|fapyrypumumuva|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fephgobd.com (Botnet_C&C)"; content:"|08|fephgobd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffickibo.com ()"; content:"|08|ffickibo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup figumsin.com (Botnet_C&C)"; content:"|08|figumsin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmome.com (Botnet_C&C)"; content:"|07|filmome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fitevejetety.com (Spyware)"; content:"|0c|fitevejetety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fosimoxexora.com (Spyware)"; content:"|0c|fosimoxexora|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fugalike.com (Malware_Infectors)"; content:"|08|fugalike|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuhocogupyneko.com (Spyware)"; content:"|0e|fuhocogupyneko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fullkeygen.net (Malware_Infectors)"; content:"|0a|fullkeygen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuqikabyko.com (Spyware)"; content:"|0a|fuqikabyko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gestaded.com ()"; content:"|08|gestaded|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gexopetoqoco.com (Spyware)"; content:"|0c|gexopetoqoco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghavs.com (Spyware)"; content:"|05|ghavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghavsgroup.com (Spyware)"; content:"|0a|ghavsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghavsinc.com (Spyware)"; content:"|08|ghavsinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghavsonline.com (Spyware)"; content:"|0b|ghavsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghavspacquiao.com (Spyware)"; content:"|0d|ghavspacquiao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghavsxp.com (Spyware)"; content:"|07|ghavsxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h4g5kjhbk3h.com (Zeus_Zbot_SpyEye)"; content:"|0b|h4g5kjhbk3h|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hermes.divinusdeus.net (Zeus_Zbot_SpyEye)"; content:"|06|hermes|0b|divinusdeus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huzatifizama.com (Spyware)"; content:"|0c|huzatifizama|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyviwysoqizege.com (Spyware)"; content:"|0e|hyviwysoqizege|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ideaidiosyncratic.info (Malware_Infectors)"; content:"|11|ideaidiosyncratic|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iproshare.vv.cc (Malware_Distribution)"; content:"|09|iproshare|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isoftwaretvdownloads.com (Malware_Distribution)"; content:"|14|isoftwaretvdownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isoftwaretvstations.com (Malware_Distribution)"; content:"|13|isoftwaretvstations|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itraf.in (Malware_Distribution)"; content:"|05|itraf|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itunesdownloadstore.com (Malware_Distribution)"; content:"|13|itunesdownloadstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jagbibiv.cn (Malware_Distribution)"; content:"|08|jagbibiv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jexelabexomeco.com (Spyware)"; content:"|0e|jexelabexomeco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joyawpan.com (Spyware)"; content:"|08|joyawpan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jukebox-download-new.com (Malware_Distribution)"; content:"|14|jukebox-download-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jukebox-new-download.com (Malware_Distribution)"; content:"|14|jukebox-new-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juqesumycuz.com (Spyware)"; content:"|0b|juqesumycuz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juxukupyzemi.com (Spyware)"; content:"|0c|juxukupyzemi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jynogobefukor.com (Spyware)"; content:"|0d|jynogobefukor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karbrrbrr.co.cc (Malware_Distribution)"; content:"|09|karbrrbrr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khumemit.cn (Malware_Distribution)"; content:"|08|khumemit|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiqevinarelo.com (Spyware)"; content:"|0c|kiqevinarelo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakersavsxp.com (Spyware)"; content:"|0b|lakersavsxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakersnavs.com (Spyware)"; content:"|0a|lakersnavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lecuvubaja.com (Spyware)"; content:"|0a|lecuvubaja|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lejicolyxudy.com (Spyware)"; content:"|0c|lejicolyxudy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lugecunecaxez.com (Spyware)"; content:"|0d|lugecunecaxez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mao.kz (Malware_Distribution)"; content:"|03|mao|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marquee8.co.cc (Malware_Infectors)"; content:"|08|marquee8|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mijokoquvon.com (Spyware)"; content:"|0b|mijokoquvon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moxopurarite.com (Spyware)"; content:"|0c|moxopurarite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mupesatupukyqi.com (Spyware)"; content:"|0e|mupesatupukyqi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musclescan.com (Spyware)"; content:"|0a|musclescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mybnavs.com (Spyware)"; content:"|07|mybnavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myghavs.com (Spyware)"; content:"|07|myghavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-jaghori.webphoto.ir (Malware_Distribution)"; content:"|0b|net-jaghori|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbnavs.com (Spyware)"; content:"|08|newbnavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash1news.com ()"; content:"|0d|newflash1news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash2news.com ()"; content:"|0d|newflash2news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash3news.com ()"; content:"|0d|newflash3news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash4news.com ()"; content:"|0d|newflash4news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash5news.com ()"; content:"|0d|newflash5news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash6news.com ()"; content:"|0d|newflash6news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash7news.com ()"; content:"|0d|newflash7news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash8news.com ()"; content:"|0d|newflash8news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflash9news.com ()"; content:"|0d|newflash9news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newghavs.com (Spyware)"; content:"|08|newghavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpdf9.com (Malware_Distribution)"; content:"|07|newpdf9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newplayer-downloads.com (Malware_Distribution)"; content:"|13|newplayer-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsatellite-tv-forpc.com (Malware_Distribution)"; content:"|15|newsatellite-tv-forpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noo.kz (Malware_Distribution)"; content:"|03|noo|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notimexonline.com (Malware_Infectors)"; content:"|0d|notimexonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nurulicovy.com (Spyware)"; content:"|0a|nurulicovy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-2010-version.com (Malware_Distribution)"; content:"|15|official-2010-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-antivirus.com (Fake_AV)"; content:"|12|official-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-online-download.com (Malware_Distribution)"; content:"|18|official-online-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-pdf-2010.com (Malware_Distribution)"; content:"|11|official-pdf-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-pdf-download.com (Malware_Distribution)"; content:"|15|official-pdf-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-pdf-pro.com (Malware_Distribution)"; content:"|10|official-pdf-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-pdf2010.com (Malware_Distribution)"; content:"|10|official-pdf2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-pdfdownload.com (Malware_Distribution)"; content:"|14|official-pdfdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-version-2011.com (Malware_Distribution)"; content:"|15|official-version-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialbirthcertificates.org (Malware_Distribution)"; content:"|19|officialbirthcertificates|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialbirthforms.org (Malware_Distribution)"; content:"|12|officialbirthforms|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialgreencard.org (Malware_Distribution)"; content:"|11|officialgreencard|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialimmigration.org (Malware_Distribution)"; content:"|13|officialimmigration|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialmarriagerecords.org (Malware_Distribution)"; content:"|17|officialmarriagerecords|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialpdf-2010.com (Malware_Distribution)"; content:"|10|officialpdf-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohbl.in (Zeus_Zbot_SpyEye)"; content:"|04|ohbl|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opera24.ru (Malware_Infectors)"; content:"|07|opera24|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overtn.com (Malware_Infectors)"; content:"|06|overtn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pacquiaoavs.com (Spyware)"; content:"|0b|pacquiaoavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patchcrack.net (Malware_Infectors)"; content:"|0a|patchcrack|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pavahikexu.com (Spyware)"; content:"|0a|pavahikexu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup philippine-embassy.ir (Malware_Distribution)"; content:"|12|philippine-embassy|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup picvance.com (Malware_Distribution)"; content:"|08|picvance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piwetyzififa.com (Spyware)"; content:"|0c|piwetyzififa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pobazepukatyc.com (Spyware)"; content:"|0d|pobazepukatyc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pyduhomyc.com (Spyware)"; content:"|09|pyduhomyc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q27vqa.co.cc (Malware_Infectors)"; content:"|06|q27vqa|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q714.co.cc (Spyware)"; content:"|04|q714|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qibahovybicu.com (Spyware)"; content:"|0c|qibahovybicu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quakearena32.ru (Malware_Infectors)"; content:"|0c|quakearena32|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickbroom.com (Spyware)"; content:"|0a|quickbroom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qupasebyve.com (Spyware)"; content:"|0a|qupasebyve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtraf.ru ()"; content:"|08|realtraf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup repavukoqipez.com (Spyware)"; content:"|0d|repavukoqipez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rodmi4e.dlinkddns.com (Spyware)"; content:"|07|rodmi4e|09|dlinkddns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ropeqeginora.com (Malware_Distribution)"; content:"|0c|ropeqeginora|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rs-323-service.ru (Malware_Infectors)"; content:"|0e|rs-323-service|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ru.coolnuff.com (Malware_Infectors)"; content:"|02|ru|08|coolnuff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rukizypufygejy.com (Spyware)"; content:"|0e|rukizypufygejy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryqytobogociw.com (Spyware)"; content:"|0d|ryqytobogociw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shadowoperations.co.cc (Zeus_Zbot_SpyEye)"; content:"|10|shadowoperations|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sisawylum.com (Spyware)"; content:"|09|sisawylum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skyline-antique.com (Malware_Distribution)"; content:"|0f|skyline-antique|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skyline-ltd.net (Malware_Distribution)"; content:"|0b|skyline-ltd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slmaat.com (Zeus_Zbot_SpyEye)"; content:"|06|slmaat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socawycerumyxi.com (Spyware)"; content:"|0e|socawycerumyxi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solaraterm.com (Malware_Distribution)"; content:"|0a|solaraterm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spider-se0rch.com (Malware_Infectors)"; content:"|0d|spider-se0rch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup squadroshield.co.cc (Spyware)"; content:"|0d|squadroshield|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup synduk.ru (Malware_Distribution)"; content:"|06|synduk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tarakan2011.ru (Malware_Infectors)"; content:"|0b|tarakan2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tedowyhubal.com (Spyware)"; content:"|0b|tedowyhubal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tesipohycuco.com (Spyware)"; content:"|0c|tesipohycuco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebnavs.com (Spyware)"; content:"|08|thebnavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theghavs.com (Spyware)"; content:"|08|theghavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thesurfrack.com ()"; content:"|0b|thesurfrack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topnglchecker.co.be (Malware_Distribution)"; content:"|0d|topnglchecker|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimawin.com (Spyware)"; content:"|09|ultimawin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup united-trans.org (Zeus_Zbot_SpyEye)"; content:"|0c|united-trans|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vanhold.com (Malware_Infectors)"; content:"|07|vanhold|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgsinfo.com (Malware_Infectors)"; content:"|07|vgsinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vinuko.de (Malware_Infectors)"; content:"|06|vinuko|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vplaylink.info (Malware_Infectors)"; content:"|09|vplaylink|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2648895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vudehebaviwod.com (Spyware)"; content:"|0d|vudehebaviwod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuvodiguqewuxe.com (Spyware)"; content:"|0e|vuvodiguqewuxe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w2c.ru (Zeus_Zbot_SpyEye)"; content:"|03|w2c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wacumohuqos.com (Spyware)"; content:"|0b|wacumohuqos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wap-files.mobi (Malware_Distribution)"; content:"|09|wap-files|04|mobi"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warez4me.ru (Malware_Distribution)"; content:"|08|warez4me|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warez72.ru ()"; content:"|07|warez72|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warez75.ru ()"; content:"|07|warez75|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wascosafaries.com (Zeus_Zbot_SpyEye)"; content:"|0d|wascosafaries|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webfrogs.ru (Malware_Distribution)"; content:"|08|webfrogs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wepomagidysaky.com (Spyware)"; content:"|0e|wepomagidysaky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woxoqehed.com (Spyware)"; content:"|09|woxoqehed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xedycekycimohu.com (Spyware)"; content:"|0e|xedycekycimohu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ya-toptal-tvoyu-dushu.com (Malware_Distribution)"; content:"|15|ya-toptal-tvoyu-dushu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yamarsian.in (Zeus_Zbot_SpyEye)"; content:"|09|yamarsian|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zagohitapuzog.com (Spyware)"; content:"|0d|zagohitapuzog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaqewoqake.com (Spyware)"; content:"|0a|zaqewoqake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zdravnadzor.ru (Zeus_Zbot_SpyEye)"; content:"|0b|zdravnadzor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zearch-lntr0duct10n.com (Malware_Infectors)"; content:"|13|zearch-lntr0duct10n|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zlen.ru (Zeus_Zbot_SpyEye)"; content:"|04|zlen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitolips.com (Malware_Distribution)"; content:"|08|bitolips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highlevel.biz (Malware_Distribution)"; content:"|09|highlevel|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pakkagit.com.tr (Malware_Distribution)"; content:"|08|pakkagit|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upperdarby26.com (Malware_Infectors)"; content:"|0c|upperdarby26|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup villusoftreit.ru (Malware_Distribution)"; content:"|0d|villusoftreit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nsecupdts.ru (Malware_Infectors)"; content:"|09|nsecupdts|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajansrena.ce.ms (Malware_Distribution)"; content:"|09|ajansrena|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestbanners1.com (Malware_Distribution)"; content:"|0c|bestbanners1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigryans.ce.ms (Malware_Distribution)"; content:"|08|bigryans|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bravepath3.com ()"; content:"|0a|bravepath3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buyordie.osa.pl (Malware_Infectors)"; content:"|08|buyordie|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checker-only-safe.co.cc (Malware_Distribution)"; content:"|11|checker-only-safe|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cmakdohaio93.in (Zeus_Zbot_SpyEye)"; content:"|0c|cmakdohaio93|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fermadeals.ce.ms (Malware_Distribution)"; content:"|0a|fermadeals|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filneso.com (Botnet_C&C)"; content:"|07|filneso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finelimeol.com (Botnet_C&C)"; content:"|0a|finelimeol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firmasteu.com (Botnet_C&C)"; content:"|09|firmasteu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firmculips.com (Botnet_C&C)"; content:"|0a|firmculips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fishrasil.com (Botnet_C&C)"; content:"|09|fishrasil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fixfiper.com (Botnet_C&C)"; content:"|08|fixfiper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fizzyoime.com (Botnet_C&C)"; content:"|09|fizzyoime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashsecuritycenter.in (Spyware)"; content:"|13|flashsecuritycenter|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flaskoof.com (Botnet_C&C)"; content:"|08|flaskoof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flasowel.com (Botnet_C&C)"; content:"|08|flasowel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flus8ush.com (Botnet_C&C)"; content:"|08|flus8ush|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forozperu.com ()"; content:"|09|forozperu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fowtorun.com (Botnet_C&C)"; content:"|08|fowtorun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxnegory.com (Botnet_C&C)"; content:"|09|foxnegory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup framebro.com (Botnet_C&C)"; content:"|08|framebro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeportindustries.ca (Malware_Infectors)"; content:"|12|freeportindustries|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuvolsia.com (Botnet_C&C)"; content:"|08|fuvolsia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuzoleup.com (Botnet_C&C)"; content:"|08|fuzoleup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabingtag.com (Botnet_C&C)"; content:"|09|gabingtag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gavutalk.com (Botnet_C&C)"; content:"|08|gavutalk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geispovs.com (Botnet_C&C)"; content:"|08|geispovs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geocanow.com (Botnet_C&C)"; content:"|08|geocanow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gifmaoers.com (Botnet_C&C)"; content:"|09|gifmaoers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giftrabcu.com (Botnet_C&C)"; content:"|09|giftrabcu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup givigbacc.com (Botnet_C&C)"; content:"|09|givigbacc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glormoafe.com (Botnet_C&C)"; content:"|09|glormoafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goamporee.com (Botnet_C&C)"; content:"|09|goamporee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goatexols.com (Botnet_C&C)"; content:"|09|goatexols|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gocratuk.com (Botnet_C&C)"; content:"|08|gocratuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godeloer.com (Botnet_C&C)"; content:"|08|godeloer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goeinrike.com (Botnet_C&C)"; content:"|09|goeinrike|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gokocnie.com (Botnet_C&C)"; content:"|08|gokocnie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldeanoc.com (Botnet_C&C)"; content:"|09|goldeanoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golenomu.com (Botnet_C&C)"; content:"|08|golenomu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gompogasu.com (Botnet_C&C)"; content:"|09|gompogasu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodatbany.com (Botnet_C&C)"; content:"|0a|goodatbany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greleklon.com (Botnet_C&C)"; content:"|09|greleklon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greloinna.com (Botnet_C&C)"; content:"|09|greloinna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groutolly.com (Botnet_C&C)"; content:"|09|groutolly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guilarkear.com (Botnet_C&C)"; content:"|0a|guilarkear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup halatylobe.com (Botnet_C&C)"; content:"|0a|halatylobe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hatfermily.com (Botnet_C&C)"; content:"|0a|hatfermily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup havecone.com (Botnet_C&C)"; content:"|08|havecone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heloacdores.com (Botnet_C&C)"; content:"|0b|heloacdores|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helonorms.com (Botnet_C&C)"; content:"|09|helonorms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helvhan.com (Botnet_C&C)"; content:"|07|helvhan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hermanotaw.com (Botnet_C&C)"; content:"|0a|hermanotaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heshareto.com (Botnet_C&C)"; content:"|09|heshareto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hickocwins.com (Botnet_C&C)"; content:"|0a|hickocwins|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup historyhuntersinternational.com (Malware_Distribution)"; content:"|1b|historyhuntersinternational|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjyu.50megs.com (Malware_Distribution)"; content:"|04|hjyu|06|50megs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgbbb.net (Malware_Infectors)"; content:"|06|imgbbb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indometastan.in (Malware_Distribution)"; content:"|0c|indometastan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ismailcetisli.com (Malware_Infectors)"; content:"|0d|ismailcetisli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabberva.cn (Malware_Distribution)"; content:"|08|jabberva|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsbanners3.com (Malware_Distribution)"; content:"|0a|jsbanners3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keywordelites.info (Botnet_C&C)"; content:"|0d|keywordelites|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiraporntube.com (Malware_Distribution)"; content:"|0c|kiraporntube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lavanda.345.pl (Malware_Distribution)"; content:"|07|lavanda|03|345|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livetvreview.com (Malware_Distribution)"; content:"|0c|livetvreview|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveufc126.com (Malware_Distribution)"; content:"|0a|liveufc126|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makemoneywith-followers.com (Malware_Distribution)"; content:"|17|makemoneywith-followers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcanavib.cn (Malware_Distribution)"; content:"|08|mcanavib|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup media-downloadcenter.com (Malware_Distribution)"; content:"|14|media-downloadcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medianewdownload.com (Malware_Distribution)"; content:"|10|medianewdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicare-forms.org (Malware_Distribution)"; content:"|0e|medicare-forms|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ab.com (Malware_Distribution)"; content:"|0f|members-area-ab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ac.com (Malware_Distribution)"; content:"|0f|members-area-ac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-as.com (Malware_Distribution)"; content:"|0f|members-area-as|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-at.com (Malware_Distribution)"; content:"|0f|members-area-at|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-av.com (Malware_Distribution)"; content:"|0f|members-area-av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ax.com (Malware_Distribution)"; content:"|0f|members-area-ax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-bl.com (Malware_Distribution)"; content:"|0f|members-area-bl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-bu.com (Malware_Distribution)"; content:"|0f|members-area-bu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ca.com (Malware_Distribution)"; content:"|0f|members-area-ca|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-cd.com (Malware_Distribution)"; content:"|0f|members-area-cd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ct.com (Malware_Distribution)"; content:"|0f|members-area-ct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-dc.com (Malware_Distribution)"; content:"|0f|members-area-dc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-di.com (Malware_Distribution)"; content:"|0f|members-area-di|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-do.com (Malware_Distribution)"; content:"|0f|members-area-do|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-dr.com (Malware_Distribution)"; content:"|0f|members-area-dr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-dt.com (Malware_Distribution)"; content:"|0f|members-area-dt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-dv.com (Malware_Distribution)"; content:"|0f|members-area-dv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ec.com (Malware_Distribution)"; content:"|0f|members-area-ec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ef.com (Malware_Distribution)"; content:"|0f|members-area-ef|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-eg.com (Malware_Distribution)"; content:"|0f|members-area-eg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-eoj.com (Malware_Distribution)"; content:"|10|members-area-eoj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-fd.com (Malware_Distribution)"; content:"|0f|members-area-fd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-fr.com (Malware_Distribution)"; content:"|0f|members-area-fr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-fw.com (Malware_Distribution)"; content:"|0f|members-area-fw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-gf.com (Malware_Distribution)"; content:"|0f|members-area-gf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-gg.com (Malware_Distribution)"; content:"|0f|members-area-gg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-gl.com (Malware_Distribution)"; content:"|0f|members-area-gl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-gm.com (Malware_Distribution)"; content:"|0f|members-area-gm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-gs.com (Malware_Distribution)"; content:"|0f|members-area-gs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-hw.com (Malware_Distribution)"; content:"|0f|members-area-hw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-hy.com (Malware_Distribution)"; content:"|0f|members-area-hy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ip.com (Malware_Distribution)"; content:"|0f|members-area-ip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-kw.com (Malware_Distribution)"; content:"|0f|members-area-kw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-mm.com (Malware_Distribution)"; content:"|0f|members-area-mm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-movies.com (Malware_Distribution)"; content:"|13|members-area-movies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-mp.com (Malware_Distribution)"; content:"|0f|members-area-mp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ms.com (Malware_Distribution)"; content:"|0f|members-area-ms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-music.com (Malware_Distribution)"; content:"|12|members-area-music|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-nc.com (Malware_Distribution)"; content:"|0f|members-area-nc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-oj.com (Malware_Distribution)"; content:"|0f|members-area-oj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-online.ru (Malware_Distribution)"; content:"|13|members-area-online|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-pd.com (Malware_Distribution)"; content:"|0f|members-area-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-pe.com (Malware_Distribution)"; content:"|0f|members-area-pe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-pf.com (Malware_Distribution)"; content:"|0f|members-area-pf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-pl.com (Malware_Distribution)"; content:"|0f|members-area-pl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-po.com (Malware_Distribution)"; content:"|0f|members-area-po|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-re.com (Malware_Distribution)"; content:"|0f|members-area-re|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-rg.com (Malware_Distribution)"; content:"|0f|members-area-rg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-rp.com (Malware_Distribution)"; content:"|0f|members-area-rp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-sa.com (Malware_Distribution)"; content:"|0f|members-area-sa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-sc.com (Malware_Distribution)"; content:"|0f|members-area-sc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-seo.com (Malware_Distribution)"; content:"|10|members-area-seo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-sl.com (Malware_Distribution)"; content:"|0f|members-area-sl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-sp.com (Malware_Distribution)"; content:"|0f|members-area-sp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ss.com (Malware_Distribution)"; content:"|0f|members-area-ss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-st.com (Malware_Distribution)"; content:"|0f|members-area-st|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ta.com (Malware_Distribution)"; content:"|0f|members-area-ta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-tv.com (Malware_Distribution)"; content:"|0f|members-area-tv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-tw.com (Malware_Distribution)"; content:"|0f|members-area-tw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-vi.com (Malware_Distribution)"; content:"|0f|members-area-vi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-vp.com (Malware_Distribution)"; content:"|0f|members-area-vp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-ws.com (Malware_Distribution)"; content:"|0f|members-area-ws|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-area-yi.com (Malware_Distribution)"; content:"|0f|members-area-yi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-site-online.com (Malware_Distribution)"; content:"|13|members-site-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup members-stream-music.com (Malware_Distribution)"; content:"|14|members-stream-music|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersarea-allinone.com (Malware_Distribution)"; content:"|14|membersarea-allinone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersarea-bookdownloads.com (Malware_Distribution)"; content:"|19|membersarea-bookdownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersarea-epa.com (Malware_Distribution)"; content:"|0f|membersarea-epa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersarea-pennyauctions.com (Malware_Distribution)"; content:"|19|membersarea-pennyauctions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersarea-xpa.com (Malware_Distribution)"; content:"|0f|membersarea-xpa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaabt.com (Malware_Distribution)"; content:"|0e|membersareaabt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaant.com (Malware_Distribution)"; content:"|0e|membersareaant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaantivirus.com (Fake_AV)"; content:"|14|membersareaantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaanx.com (Malware_Distribution)"; content:"|0e|membersareaanx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaasp.com (Malware_Distribution)"; content:"|0e|membersareaasp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaavr.com (Malware_Distribution)"; content:"|0e|membersareaavr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareabkd.com (Malware_Distribution)"; content:"|0e|membersareabkd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareabur.com (Malware_Distribution)"; content:"|0e|membersareabur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareacdt.com (Malware_Distribution)"; content:"|0e|membersareacdt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareadie.com (Malware_Distribution)"; content:"|0e|membersareadie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaear.com (Malware_Distribution)"; content:"|0e|membersareaear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaeba.com (Malware_Distribution)"; content:"|0e|membersareaeba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareafed.com (Malware_Distribution)"; content:"|0e|membersareafed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareafit.com (Malware_Distribution)"; content:"|0e|membersareafit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareafla.com (Malware_Distribution)"; content:"|0e|membersareafla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareagam.com (Malware_Distribution)"; content:"|0e|membersareagam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareagms.com (Malware_Distribution)"; content:"|0e|membersareagms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareahwr.com (Malware_Distribution)"; content:"|0e|membersareahwr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaipd.com (Malware_Distribution)"; content:"|0e|membersareaipd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersarealogin.com (Malware_Distribution)"; content:"|10|membersarealogin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareamed.com (Malware_Distribution)"; content:"|0e|membersareamed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareamob.com (Malware_Distribution)"; content:"|0e|membersareamob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareamov.com (Malware_Distribution)"; content:"|0e|membersareamov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareamovie.com (Malware_Distribution)"; content:"|10|membersareamovie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareamus.com (Malware_Distribution)"; content:"|0e|membersareamus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareamusic.com (Malware_Distribution)"; content:"|10|membersareamusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaoof.com (Malware_Distribution)"; content:"|0e|membersareaoof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareapdo.com (Malware_Distribution)"; content:"|0e|membersareapdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareapet.com (Malware_Distribution)"; content:"|0e|membersareapet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareappl.com (Malware_Distribution)"; content:"|0e|membersareappl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareapss.com (Malware_Distribution)"; content:"|0e|membersareapss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareapsx.com (Malware_Distribution)"; content:"|0e|membersareapsx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareask.com (Malware_Distribution)"; content:"|0d|membersareask|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareasky.com (Malware_Distribution)"; content:"|0e|membersareasky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareasof.com (Malware_Distribution)"; content:"|0e|membersareasof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareaspo.com (Malware_Distribution)"; content:"|0e|membersareaspo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareasst.com (Malware_Distribution)"; content:"|0e|membersareasst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareatvt.com (Malware_Distribution)"; content:"|0e|membersareatvt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareatwi.com (Malware_Distribution)"; content:"|0e|membersareatwi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareavir.com (Malware_Distribution)"; content:"|0e|membersareavir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareawdo.com (Malware_Distribution)"; content:"|0e|membersareawdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membersareazpl.com (Malware_Distribution)"; content:"|0e|membersareazpl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memberssitelogin.com (Malware_Distribution)"; content:"|10|memberssitelogin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup messenger-download-2010.com (Malware_Distribution)"; content:"|17|messenger-download-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup messenger-downloads.com (Malware_Distribution)"; content:"|13|messenger-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup messenger-free-download.com (Malware_Distribution)"; content:"|17|messenger-free-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup messenger-new.com (Malware_Distribution)"; content:"|0d|messenger-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup midgiluo.com (Botnet_C&C)"; content:"|08|midgiluo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modiesto.com (Botnet_C&C)"; content:"|08|modiesto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup music-tunesdownload.com (Malware_Distribution)"; content:"|13|music-tunesdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicdownload-site.com (Malware_Distribution)"; content:"|12|musicdownload-site|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicdownloadreview.info (Malware_Distribution)"; content:"|13|musicdownloadreview|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicmembersarea.com (Malware_Distribution)"; content:"|10|musicmembersarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musique-2010.com (Malware_Distribution)"; content:"|0c|musique-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musique-2011.com (Malware_Distribution)"; content:"|0c|musique-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mvamelov.cn (Malware_Distribution)"; content:"|08|mvamelov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-mediacenter.com (Malware_Distribution)"; content:"|0e|my-mediacenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-stream-tv.com (Malware_Distribution)"; content:"|0c|my-stream-tv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-streampass.com (Malware_Distribution)"; content:"|0d|my-streampass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mydownloadings.com (Malware_Distribution)"; content:"|0e|mydownloadings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-gamedownloading.com (Malware_Distribution)"; content:"|13|net-gamedownloading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-moviedownloads.net (Malware_Distribution)"; content:"|12|net-moviedownloads|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netmoviedownloads.com (Malware_Distribution)"; content:"|11|netmoviedownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netmovies-download.com (Malware_Distribution)"; content:"|12|netmovies-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-2010-download.com (Malware_Distribution)"; content:"|11|new-2010-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-2010-pdf-download.com (Malware_Distribution)"; content:"|15|new-2010-pdf-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-2011-online-version.com (Malware_Distribution)"; content:"|17|new-2011-online-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-antivirus-version.com (Fake_AV)"; content:"|15|new-antivirus-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-burner.com (Malware_Distribution)"; content:"|0a|new-burner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-earth-locations.com (Malware_Distribution)"; content:"|13|new-earth-locations|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-gamingexperience.com (Malware_Distribution)"; content:"|14|new-gamingexperience|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-hd-movies-online.com (Malware_Distribution)"; content:"|14|new-hd-movies-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-install.com (Malware_Distribution)"; content:"|0b|new-install|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-instant-download.com (Malware_Distribution)"; content:"|14|new-instant-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-internettelevision.com (Malware_Distribution)"; content:"|16|new-internettelevision|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-music-online.com (Malware_Distribution)"; content:"|10|new-music-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-online-version.com (Malware_Distribution)"; content:"|12|new-online-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-pdf-2011.com (Malware_Distribution)"; content:"|0c|new-pdf-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-pdf-online-download.com (Malware_Distribution)"; content:"|17|new-pdf-online-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-pdf-reader.com (Malware_Distribution)"; content:"|0e|new-pdf-reader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-pdf9.com (Malware_Distribution)"; content:"|08|new-pdf9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-recorder.com (Malware_Distribution)"; content:"|0c|new-recorder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-tv-online-access.com (Malware_Distribution)"; content:"|14|new-tv-online-access|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-tv-online-access.net (Malware_Distribution)"; content:"|14|new-tv-online-access|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-tv-to-pc.com (Malware_Distribution)"; content:"|0c|new-tv-to-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-version-online.com (Malware_Distribution)"; content:"|12|new-version-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-voice-ip.com (Malware_Distribution)"; content:"|0c|new-voice-ip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-voip-2010-download.com (Malware_Distribution)"; content:"|16|new-voip-2010-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-voip-2011-download.com (Malware_Distribution)"; content:"|16|new-voip-2011-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-voip-access.com (Malware_Distribution)"; content:"|0f|new-voip-access|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-voip-instant-access.com (Malware_Distribution)"; content:"|17|new-voip-instant-access|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-voip-latest-download.com (Malware_Distribution)"; content:"|18|new-voip-latest-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-voip-online-access.com (Malware_Distribution)"; content:"|16|new-voip-online-access|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-web-download.com (Malware_Distribution)"; content:"|10|new-web-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newantivirusdownload.com (Fake_AV)"; content:"|14|newantivirusdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ringostart.osa.pl (Malware_Infectors)"; content:"|0a|ringostart|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seaarch.info (Malware_Distribution)"; content:"|07|seaarch|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shalisally.ce.ms (Malware_Distribution)"; content:"|0a|shalisally|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stceltensarg.ce.ms (Malware_Distribution)"; content:"|0c|stceltensarg|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stillalives.ce.ms (Malware_Distribution)"; content:"|0b|stillalives|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ticetegas.com (Botnet_C&C)"; content:"|09|ticetegas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todgekaw.com (Botnet_C&C)"; content:"|08|todgekaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup varealestateblog.com (Zeus_Zbot_SpyEye)"; content:"|10|varealestateblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup versepurze.com (Zeus_Zbot_SpyEye)"; content:"|0a|versepurze|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warwork.info (Malware_Distribution)"; content:"|07|warwork|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wdjpq.ne (Malware_Infectors)"; content:"|05|wdjpq|02|ne"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wertlist.com ()"; content:"|08|wertlist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winupdatecentr.in (Spyware)"; content:"|0e|winupdatecentr|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrewa.ifrance.com (Malware_Distribution)"; content:"|05|wrewa|07|ifrance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalpoweringgathering.com (Malware_Distribution)"; content:"|17|globalpoweringgathering|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milapop.com (Malware_Distribution)"; content:"|07|milapop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promo-park.ru (Malware_Distribution)"; content:"|0a|promo-park|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vir-tuta.ru (Malware_Distribution)"; content:"|08|vir-tuta|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0fees.net (Malware_Distribution)"; content:"|05|0fees|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 19995588.com (Malware_Distribution)"; content:"|08|19995588|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1mmjl3l45lkjbdb.ru (Botnet_C&C)"; content:"|0f|1mmjl3l45lkjbdb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 27cms.eu (Malware_Distribution)"; content:"|05|27cms|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 60gp.ovh.net (Malware_Distribution)"; content:"|04|60gp|03|ovh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abodeflashplayer.co.tv (Malware_Distribution)"; content:"|10|abodeflashplayer|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup act1floral.ce.ms (Malware_Infectors)"; content:"|0a|act1floral|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agreement52.com (Botnet_C&C)"; content:"|0b|agreement52|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aloveb.biz (Malware_Distribution)"; content:"|06|aloveb|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ameryvarlaam.ru (Spyware)"; content:"|0c|ameryvarlaam|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astro-cash.biz (Malware_Distribution)"; content:"|0a|astro-cash|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atuno.it (Malware_Distribution)"; content:"|05|atuno|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-america.com (Spyware)"; content:"|0b|avs-america|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-carter.com (Spyware)"; content:"|0a|avs-carter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-elite.com (Spyware)"; content:"|09|avs-elite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-industry.com (Spyware)"; content:"|0c|avs-industry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-mobile.com (Spyware)"; content:"|0a|avs-mobile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-nevada.com (Spyware)"; content:"|0a|avs-nevada|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-prime.com (Spyware)"; content:"|09|avs-prime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-property.com (Spyware)"; content:"|0c|avs-property|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-retail.com (Spyware)"; content:"|0a|avs-retail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-solutions.com (Spyware)"; content:"|0d|avs-solutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-tech.com (Spyware)"; content:"|08|avs-tech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-thai.com (Spyware)"; content:"|08|avs-thai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avs-tract.com (Spyware)"; content:"|09|avs-tract|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsdelivery.com (Spyware)"; content:"|0b|avsdelivery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avselite.com (Spyware)"; content:"|08|avselite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsindustry.com (Spyware)"; content:"|0b|avsindustry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avslakers.com (Spyware)"; content:"|09|avslakers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsphotography.com (Spyware)"; content:"|0e|avsphotography|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsretail.com (Spyware)"; content:"|09|avsretail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avstract.com (Spyware)"; content:"|08|avstract|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avswer.com (Spyware)"; content:"|06|avswer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avswergroup.com (Spyware)"; content:"|0b|avswergroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avswerlakers.com (Spyware)"; content:"|0c|avswerlakers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsweronline.com (Spyware)"; content:"|0c|avsweronline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avswerxp.com (Spyware)"; content:"|08|avswerxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bumbara.co.cc (Malware_Distribution)"; content:"|07|bumbara|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup csmart.co.kr (Malware_Distribution)"; content:"|06|csmart|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dietacaiberry.net (Malware_Distribution)"; content:"|0d|dietacaiberry|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dirtyrottenwhore.com (Malware_Distribution)"; content:"|10|dirtyrottenwhore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djevel00.fileave.com (Malware_Distribution)"; content:"|08|djevel00|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dmzcamp.com (Malware_Infectors)"; content:"|07|dmzcamp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drricardoyepez.org (Malware_Distribution)"; content:"|0e|drricardoyepez|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebooksit.com (Malware_Distribution)"; content:"|08|ebooksit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup einemenge.info (Malware_Distribution)"; content:"|09|einemenge|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elpcez.ce.ms (Malware_Distribution)"; content:"|06|elpcez|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esformofset.com (Malware_Distribution)"; content:"|0b|esformofset|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup europole-formations.fr (Malware_Distribution)"; content:"|13|europole-formations|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exbii.com (Malware_Distribution)"; content:"|05|exbii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup financialdeposit.com (Botnet_C&C)"; content:"|10|financialdeposit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fkfxzhxxqk.cx.cc (Spyware)"; content:"|0a|fkfxzhxxqk|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashloads.net (Malware_Distribution)"; content:"|0a|flashloads|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frankiees.ru (Malware_Infectors)"; content:"|09|frankiees|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frankieeus.ru (Malware_Infectors)"; content:"|0a|frankieeus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friskyvids.com (Malware_Distribution)"; content:"|0a|friskyvids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamesbaidu.com (Zeus_Zbot_SpyEye)"; content:"|0a|gamesbaidu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaufridboris.ru (Malware_Infectors)"; content:"|0c|gaufridboris|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getwayshop.ru (Malware_Distribution)"; content:"|0a|getwayshop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giantsoft.co.kr (Malware_Infectors)"; content:"|09|giantsoft|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goleleila.ir (Malware_Distribution)"; content:"|09|goleleila|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gopinathabengt.ru (Spyware)"; content:"|0e|gopinathabengt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwynyasser.ru (Spyware)"; content:"|0a|gwynyasser|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gzjianren.com (Malware_Distribution)"; content:"|09|gzjianren|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h7k.in (Malware_Distribution)"; content:"|03|h7k|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hideomechanic.com (Zeus_Zbot_SpyEye)"; content:"|0d|hideomechanic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosting161-flash.redirectme.net (Malware_Distribution)"; content:"|10|hosting161-flash|0a|redirectme|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqxvideofree.com (Malware_Distribution)"; content:"|0c|hqxvideofree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hzcor.ce.ms (Malware_Distribution)"; content:"|05|hzcor|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hzw.co.be (Malware_Distribution)"; content:"|03|hzw|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idatelyfumiu.linkpc.net (Malware_Distribution)"; content:"|0c|idatelyfumiu|06|linkpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jasoncmeyer.ce.ms (Malware_Infectors)"; content:"|0b|jasoncmeyer|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jdfehxrzsbtrbiju.com (Malware_Distribution)"; content:"|10|jdfehxrzsbtrbiju|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jh99-v5.cable-modem.org (Malware_Distribution)"; content:"|07|jh99-v5|0b|cable-modem|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ji0ns.com (Malware_Infectors)"; content:"|05|ji0ns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsbanners7.com (Malware_Distribution)"; content:"|0a|jsbanners7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsbanners8.com (Malware_Distribution)"; content:"|0a|jsbanners8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jwjmusic.cx.cc (Malware_Infectors)"; content:"|08|jwjmusic|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kamarovoskolkovo.ru (Spyware)"; content:"|10|kamarovoskolkovo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kangnam.co.kr (Malware_Distribution)"; content:"|07|kangnam|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karabasbaraba.ru (Spyware)"; content:"|0d|karabasbaraba|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingofpirates.co.cc (Malware_Distribution)"; content:"|0d|kingofpirates|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kljygsvbfs.in (Spyware)"; content:"|0a|kljygsvbfs|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klubnika34his.com (Malware_Infectors)"; content:"|0d|klubnika34his|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kol0.com (Malware_Distribution)"; content:"|04|kol0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kombek.org (Malware_Distribution)"; content:"|06|kombek|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kosmodromkan.ru (Spyware)"; content:"|0c|kosmodromkan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kposjuhnfs.in (Spyware)"; content:"|0a|kposjuhnfs|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakersvswer.com (Spyware)"; content:"|0b|lakersvswer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lcvjooxjnd.cx.cc (Spyware)"; content:"|0a|lcvjooxjnd|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leonidyonah.ru (Spyware)"; content:"|0b|leonidyonah|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lfug.co.cc (Malware_Distribution)"; content:"|04|lfug|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediamodifydata.in (Malware_Distribution)"; content:"|14|multimediamodifydata|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavswer.com (Spyware)"; content:"|08|myavswer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myobfuscate.com (Malware_Distribution)"; content:"|0b|myobfuscate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywebspace1.tld.tc (Spyware)"; content:"|0b|mywebspace1|03|tld|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myzhuzi.com (Malware_Distribution)"; content:"|07|myzhuzi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup needble-for.findhere.org (Malware_Distribution)"; content:"|0b|needble-for|08|findhere|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavswer.com (Spyware)"; content:"|09|newavswer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newinet.co.cc (Malware_Distribution)"; content:"|07|newinet|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newtubes.in (Spyware)"; content:"|08|newtubes|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nowdonload.co.cc (Malware_Distribution)"; content:"|0a|nowdonload|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nxmtv.info (Malware_Distribution)"; content:"|05|nxmtv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyoflak.com (Malware_Distribution)"; content:"|07|nyoflak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oboi-msk.ru (Spyware)"; content:"|08|oboi-msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialversion.su (Malware_Distribution)"; content:"|0f|officialversion|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olasaqyuijuk.linkpc.net (Malware_Distribution)"; content:"|0c|olasaqyuijuk|06|linkpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on10news.com ()"; content:"|08|on10news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on10news.ru ()"; content:"|08|on10news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on11news.com ()"; content:"|08|on11news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on11news.ru ()"; content:"|08|on11news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on12news.com ()"; content:"|08|on12news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on12news.ru ()"; content:"|08|on12news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on13news.com ()"; content:"|08|on13news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on13news.ru ()"; content:"|08|on13news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on14news.ru ()"; content:"|08|on14news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on15news.ru ()"; content:"|08|on15news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on16news.ru ()"; content:"|08|on16news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on17news.ru ()"; content:"|08|on17news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on18news.ru ()"; content:"|08|on18news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on19news.ru ()"; content:"|08|on19news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on1news.com ()"; content:"|07|on1news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on1news.ru ()"; content:"|07|on1news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on20news.ru ()"; content:"|08|on20news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on2news.com ()"; content:"|07|on2news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on2news.ru ()"; content:"|07|on2news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on3news.com ()"; content:"|07|on3news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online11news.com ()"; content:"|0c|online11news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online11news.ru ()"; content:"|0c|online11news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online12flash.com ()"; content:"|0d|online12flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online12news.com ()"; content:"|0c|online12news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online12news.ru ()"; content:"|0c|online12news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online13flash.com ()"; content:"|0d|online13flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online13news.com ()"; content:"|0c|online13news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online13news.ru ()"; content:"|0c|online13news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online14flash.com ()"; content:"|0d|online14flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online14news.com ()"; content:"|0c|online14news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online14news.ru ()"; content:"|0c|online14news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online15flash.com ()"; content:"|0d|online15flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online15news.com ()"; content:"|0c|online15news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online15news.ru ()"; content:"|0c|online15news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online16flash.com ()"; content:"|0d|online16flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online16news.com ()"; content:"|0c|online16news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online16news.ru ()"; content:"|0c|online16news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online17news.com ()"; content:"|0c|online17news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online17news.ru ()"; content:"|0c|online17news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online18news.com ()"; content:"|0c|online18news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online18news.ru ()"; content:"|0c|online18news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online19news.com ()"; content:"|0c|online19news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online19news.ru ()"; content:"|0c|online19news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online1news.ru ()"; content:"|0b|online1news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online20news.ru ()"; content:"|0c|online20news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online2flash.com ()"; content:"|0c|online2flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online2news.ru ()"; content:"|0b|online2news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online3flash.com ()"; content:"|0c|online3flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online3news.ru ()"; content:"|0b|online3news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online4flash.com ()"; content:"|0c|online4flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online4news.ru ()"; content:"|0b|online4news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online5flash.com ()"; content:"|0c|online5flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online5news.ru ()"; content:"|0b|online5news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online6flash.com ()"; content:"|0c|online6flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online6news.ru ()"; content:"|0b|online6news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online7flash.com ()"; content:"|0c|online7flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online7news.ru ()"; content:"|0b|online7news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online8flash.com ()"; content:"|0c|online8flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online8news.ru ()"; content:"|0b|online8news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online9flash.com ()"; content:"|0c|online9flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online9news.ru ()"; content:"|0b|online9news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinehome-writer.com (Malware_Distribution)"; content:"|11|onlinehome-writer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parrisherakles.ru (Spyware)"; content:"|0e|parrisherakles|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promoads.eu (Malware_Distribution)"; content:"|08|promoads|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qhnfmmpp.co.cc (Malware_Distribution)"; content:"|08|qhnfmmpp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwechecksystem.com (Malware_Distribution)"; content:"|0e|qwechecksystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qzgsl.com (Malware_Distribution)"; content:"|05|qzgsl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realdyhelp.rr.nu (Malware_Distribution)"; content:"|0a|realdyhelp|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjhomesolutions.com (Spyware)"; content:"|0f|rjhomesolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sajjadiuppiter.ru (Spyware)"; content:"|0e|sajjadiuppiter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sextubecentral.com (Malware_Distribution)"; content:"|0e|sextubecentral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexxeschikkaxxx.serveftp.com (Malware_Distribution)"; content:"|0f|sexxeschikkaxxx|08|serveftp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexyteenage.net (Malware_Distribution)"; content:"|0b|sexyteenage|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopgetway.ru (Malware_Distribution)"; content:"|0a|shopgetway|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-avs.com (Spyware)"; content:"|0c|software-avs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soptnsa.co.cc (Malware_Distribution)"; content:"|07|soptnsa|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup star99.info (Malware_Distribution)"; content:"|06|star99|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statpdomwas.cx.cc (Malware_Distribution)"; content:"|0b|statpdomwas|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stephanos.ru (Malware_Infectors)"; content:"|09|stephanos|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strongmdefense.findhere.org (Malware_Distribution)"; content:"|0e|strongmdefense|08|findhere|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup svatebniprani.us (Malware_Distribution)"; content:"|0d|svatebniprani|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theavswer.com (Spyware)"; content:"|09|theavswer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tnbzrkrm.co.cc (Malware_Distribution)"; content:"|08|tnbzrkrm|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tomaromain.ru (Spyware)"; content:"|0a|tomaromain|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackups.org (Zeus_Zbot_SpyEye)"; content:"|08|trackups|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradekerala.com (Malware_Distribution)"; content:"|0b|tradekerala|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubedownloader2010.com (Malware_Distribution)"; content:"|12|tubedownloader2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tunes-new-online-downloads.com (Malware_Distribution)"; content:"|1a|tunes-new-online-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tvmovie-sale.com (Malware_Distribution)"; content:"|0c|tvmovie-sale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tvsportschannel.com (Malware_Distribution)"; content:"|0f|tvsportschannel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tweeter001.co.cc (Malware_Distribution)"; content:"|0a|tweeter001|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubitorent.com (Malware_Distribution)"; content:"|09|ubitorent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upsclients.com (Spyware)"; content:"|0a|upsclients|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upstrack.net (Spyware)"; content:"|08|upstrack|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ushcime.com (Malware_Infectors)"; content:"|07|ushcime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usps.com.trackr04.com (Malware_Distribution)"; content:"|04|usps|03|com|08|trackr04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vaccineu.com (Malware_Distribution)"; content:"|08|vaccineu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videospornodetv.com (Malware_Distribution)"; content:"|0f|videospornodetv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vtqssamktp.cx.cc (Spyware)"; content:"|0a|vtqssamktp|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-worldmap.com (Malware_Distribution)"; content:"|0c|web-worldmap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webwarper.net (Malware_Distribution)"; content:"|09|webwarper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whitesmoke.co.il (Zeus_Zbot_SpyEye)"; content:"|0a|whitesmoke|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whitesmoke.us (Zeus_Zbot_SpyEye)"; content:"|0a|whitesmoke|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdnsrv.com (Zeus_Zbot_SpyEye)"; content:"|06|xdnsrv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xrtik.ipq.co (Malware_Distribution)"; content:"|05|xrtik|03|ipq|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ydimefanilyju.linkpc.net (Malware_Distribution)"; content:"|0d|ydimefanilyju|06|linkpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zalsdre.vv.cc (Malware_Distribution)"; content:"|07|zalsdre|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeckzer.ce.ms (Malware_Distribution)"; content:"|07|zeckzer|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zojozvrm.co.cc (Malware_Distribution)"; content:"|08|zojozvrm|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acararira.com (Spyware)"; content:"|09|acararira|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acwoode-group.com (Phishing_and_Theft)"; content:"|0d|acwoode-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acwoode-group.net (Phishing_and_Theft)"; content:"|0d|acwoode-group|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adeqahycuful.com (Spyware)"; content:"|0c|adeqahycuful|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahrampress.net ()"; content:"|0a|ahrampress|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alucewyfyxut.com (Spyware)"; content:"|0c|alucewyfyxut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alunepuher.com (Spyware)"; content:"|0a|alunepuher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americancareerguide.com (Phishing_and_Theft)"; content:"|13|americancareerguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amymosyzylub.com (Spyware)"; content:"|0c|amymosyzylub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-support2011.com (Fake_AV)"; content:"|15|antivirus-support2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apexilo.com (Phishing_and_Theft)"; content:"|07|apexilo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup art-gapson.com (Phishing_and_Theft)"; content:"|0a|art-gapson|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attorney-at-jew.ru ()"; content:"|0f|attorney-at-jew|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banermusic1.com (Malware_Distribution)"; content:"|0b|banermusic1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banermusic2.com (Malware_Distribution)"; content:"|0b|banermusic2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banermusic3.com (Malware_Distribution)"; content:"|0b|banermusic3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banermusic4.com (Malware_Distribution)"; content:"|0b|banermusic4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banermusic5.com (Malware_Distribution)"; content:"|0b|banermusic5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banermusic6.com (Malware_Distribution)"; content:"|0b|banermusic6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banermusic7.com (Malware_Distribution)"; content:"|0b|banermusic7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banermusic8.com (Malware_Distribution)"; content:"|0b|banermusic8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banermusic9.com (Malware_Distribution)"; content:"|0b|banermusic9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banescoenlineas.com (Botnet_C&C)"; content:"|0f|banescoenlineas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barbarastrasland.ru (Spyware)"; content:"|10|barbarastrasland|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup befordsouthpointford.com (Malware_Distribution)"; content:"|14|befordsouthpointford|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz141news.ru ()"; content:"|0a|biz141news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz14flash.com ()"; content:"|0a|biz14flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz14news.ru ()"; content:"|09|biz14news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz151news.ru ()"; content:"|0a|biz151news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz15flash.com ()"; content:"|0a|biz15flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz15news.ru ()"; content:"|09|biz15news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz161news.ru ()"; content:"|0a|biz161news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz16flash.com ()"; content:"|0a|biz16flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz16news.ru ()"; content:"|09|biz16news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz171news.ru ()"; content:"|0a|biz171news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz17flash.com ()"; content:"|0a|biz17flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz17news.ru ()"; content:"|09|biz17news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz181news.ru ()"; content:"|0a|biz181news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz18flash.com ()"; content:"|0a|biz18flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz18news.ru ()"; content:"|09|biz18news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz191news.ru ()"; content:"|0a|biz191news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz19flash.com ()"; content:"|0a|biz19flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz19news.ru ()"; content:"|09|biz19news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz1news.ru ()"; content:"|08|biz1news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz201news.ru ()"; content:"|0a|biz201news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz20flash.com ()"; content:"|0a|biz20flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz20news.ru ()"; content:"|09|biz20news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz211news.ru ()"; content:"|0a|biz211news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz21flash.com ()"; content:"|0a|biz21flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz21news.ru ()"; content:"|09|biz21news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz221news.ru ()"; content:"|0a|biz221news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz22flash.com ()"; content:"|0a|biz22flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz22news.ru ()"; content:"|09|biz22news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz231news.ru ()"; content:"|0a|biz231news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz23flash.com ()"; content:"|0a|biz23flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz23news.ru ()"; content:"|09|biz23news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz241news.ru ()"; content:"|0a|biz241news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz24flash.com ()"; content:"|0a|biz24flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz24news.ru ()"; content:"|09|biz24news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz251news.ru ()"; content:"|0a|biz251news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz25flash.com ()"; content:"|0a|biz25flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz25news.ru ()"; content:"|09|biz25news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz261news.ru ()"; content:"|0a|biz261news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz26flash.com ()"; content:"|0a|biz26flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz26news.ru ()"; content:"|09|biz26news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz30flash.com ()"; content:"|0a|biz30flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz31flash.com ()"; content:"|0a|biz31flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz32flash.com ()"; content:"|0a|biz32flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz33flash.com ()"; content:"|0a|biz33flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz34flash.com ()"; content:"|0a|biz34flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz35flash.com ()"; content:"|0a|biz35flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz36flash.com ()"; content:"|0a|biz36flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz37flash.com ()"; content:"|0a|biz37flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz3news.ru ()"; content:"|08|biz3news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz4news.ru ()"; content:"|08|biz4news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz50flash.ru ()"; content:"|0a|biz50flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz55flash.ru ()"; content:"|0a|biz55flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz5news.ru ()"; content:"|08|biz5news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz61flash.ru ()"; content:"|0a|biz61flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz6news.ru ()"; content:"|08|biz6news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz71news.ru ()"; content:"|09|biz71news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz7news.ru ()"; content:"|08|biz7news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz8news.ru ()"; content:"|08|biz8news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz91news.ru ()"; content:"|09|biz91news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz94flash.ru ()"; content:"|0a|biz94flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz95flash.ru ()"; content:"|0a|biz95flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz96flash.ru ()"; content:"|0a|biz96flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz97flash.ru ()"; content:"|0a|biz97flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz99flash.ru ()"; content:"|0a|biz99flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz9news.ru ()"; content:"|08|biz9news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev10news.com ()"; content:"|0c|bizdev10news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev11news.com ()"; content:"|0c|bizdev11news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev12news.com ()"; content:"|0c|bizdev12news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev13news.com ()"; content:"|0c|bizdev13news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev14news.com ()"; content:"|0c|bizdev14news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev15news.com ()"; content:"|0c|bizdev15news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev16news.com ()"; content:"|0c|bizdev16news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev17news.com ()"; content:"|0c|bizdev17news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev18news.com ()"; content:"|0c|bizdev18news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizdev19news.com ()"; content:"|0c|bizdev19news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluesong.org (Malware_Distribution)"; content:"|08|bluesong|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bogdantevye.ru (Malware_Infectors)"; content:"|0b|bogdantevye|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup botikov.eu.tf (Malware_Distribution)"; content:"|07|botikov|02|eu|02|tf"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brenk909.fileave.com (Malware_Distribution)"; content:"|08|brenk909|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunifekaybecou.linkpc.net (Malware_Distribution)"; content:"|0e|bunifekaybecou|06|linkpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byceifylejybun.linkpc.net (Malware_Distribution)"; content:"|0e|byceifylejybun|06|linkpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cali7ny.us (Spyware)"; content:"|07|cali7ny|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cali8ny.us (Spyware)"; content:"|07|cali8ny|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canadacareersource.com (Phishing_and_Theft)"; content:"|12|canadacareersource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canditrack.net (Phishing_and_Theft)"; content:"|0a|canditrack|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canditracker.com (Phishing_and_Theft)"; content:"|0c|canditracker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleantechenpro.com (Zeus_Zbot_SpyEye)"; content:"|0e|cleantechenpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnvxqspmtxlnsmow.biz (Malware_Distribution)"; content:"|10|cnvxqspmtxlnsmow|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collegeboundcanada.com (Phishing_and_Theft)"; content:"|12|collegeboundcanada|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collegedatabase.us (Phishing_and_Theft)"; content:"|0f|collegedatabase|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collegedatabasecanada.com (Phishing_and_Theft)"; content:"|15|collegedatabasecanada|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collegematchcanada.com (Phishing_and_Theft)"; content:"|12|collegematchcanada|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creativedesigncareers.com (Phishing_and_Theft)"; content:"|15|creativedesigncareers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crissnot4me.com (Spyware)"; content:"|0b|crissnot4me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curryhouse.com.kw (Malware_Infectors)"; content:"|0a|curryhouse|03|com|02|kw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup customavs.com (Spyware)"; content:"|09|customavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dawsontristan.ru (Spyware)"; content:"|0d|dawsontristan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup de-dvfgroup.be (Phishing_and_Theft)"; content:"|0b|de-dvfgroup|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-uvpsx.vv.cc (Malware_Distribution)"; content:"|0e|defender-uvpsx|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-wcxsx.vv.cc (Malware_Distribution)"; content:"|0e|defender-wcxsx|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup degreesforsoldiers.com (Phishing_and_Theft)"; content:"|12|degreesforsoldiers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup degreesfortruckers.com (Phishing_and_Theft)"; content:"|12|degreesfortruckers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dentalassistantcareers.net (Phishing_and_Theft)"; content:"|16|dentalassistantcareers|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhanfamily.com (Malware_Distribution)"; content:"|0a|dhanfamily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digital-avs.com (Spyware)"; content:"|0b|digital-avs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dmera.com ()"; content:"|05|dmera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drwhox.com ()"; content:"|06|drwhox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebatmoyhuy.com (Malware_Distribution)"; content:"|0a|ebatmoyhuy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elenty-co.net (Phishing_and_Theft)"; content:"|09|elenty-co|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elenty-llc.com (Phishing_and_Theft)"; content:"|0a|elenty-llc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup employerdynamics.com (Phishing_and_Theft)"; content:"|10|employerdynamics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enderlabs.com (Phishing_and_Theft)"; content:"|09|enderlabs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup equalcredit.org (Phishing_and_Theft)"; content:"|0b|equalcredit|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eventboardapp.com (Phishing_and_Theft)"; content:"|0d|eventboardapp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evodvdstar.com (Malware_Distribution)"; content:"|0a|evodvdstar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fettucini-mushfood.biz ()"; content:"|12|fettucini-mushfood|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gapsonart.net (Phishing_and_Theft)"; content:"|09|gapsonart|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getmedicaleducation.com (Phishing_and_Theft)"; content:"|13|getmedicaleducation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gmd-contracting.com (Phishing_and_Theft)"; content:"|0f|gmd-contracting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guru-group.cc (Phishing_and_Theft)"; content:"|0a|guru-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guru-group.net (Phishing_and_Theft)"; content:"|0a|guru-group|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hupugivuz.com (Spyware)"; content:"|09|hupugivuz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihear.co.kr (Malware_Infectors)"; content:"|05|ihear|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instant-new-download.com (Malware_Distribution)"; content:"|14|instant-new-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intechtodex-group.com (Phishing_and_Theft)"; content:"|11|intechtodex-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-televisiononline.com (Malware_Distribution)"; content:"|19|internet-televisiononline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-tv-networks.com (Malware_Distribution)"; content:"|14|internet-tv-networks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javarequest.com ()"; content:"|0b|javarequest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jevwayyq.ce.ms (Spyware)"; content:"|08|jevwayyq|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjaqtlionjhstyo.com (Malware_Distribution)"; content:"|0f|jjaqtlionjhstyo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kandagar-bank.in ()"; content:"|0d|kandagar-bank|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kkeldtkloryrfwwt.com (Malware_Distribution)"; content:"|10|kkeldtkloryrfwwt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kmesomkisipfyo.com (Malware_Distribution)"; content:"|0e|kmesomkisipfyo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lacrowood.com (Malware_Distribution)"; content:"|09|lacrowood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup likethis.co (Malware_Distribution)"; content:"|08|likethis|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup link-avs.com (Spyware)"; content:"|08|link-avs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkavs.com (Spyware)"; content:"|07|linkavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liqevesagis.com (Spyware)"; content:"|0b|liqevesagis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litubibam.com (Spyware)"; content:"|09|litubibam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livesaltlake.com (Phishing_and_Theft)"; content:"|0c|livesaltlake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkllkrnowzvnurl.com (Malware_Distribution)"; content:"|0f|lkllkrnowzvnurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadsped.co.cc (Malware_Distribution)"; content:"|08|loadsped|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loshijosdebriones.com (Malware_Distribution)"; content:"|11|loshijosdebriones|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ltnqgnwliorcs.biz (Malware_Distribution)"; content:"|0d|ltnqgnwliorcs|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m24m.in (Zeus_Zbot_SpyEye)"; content:"|04|m24m|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m2520m.in (Malware_Distribution)"; content:"|06|m2520m|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mabtion.cn (Botnet_C&C)"; content:"|07|mabtion|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdqntypieiykpij.org (Malware_Distribution)"; content:"|0f|mdqntypieiykpij|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaplussoft.com (Malware_Distribution)"; content:"|0d|mediaplussoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicalbillingrecruiter.com (Phishing_and_Theft)"; content:"|17|medicalbillingrecruiter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup merdoc.net (Malware_Distribution)"; content:"|06|merdoc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miyazakihousou.com (Spyware)"; content:"|0e|miyazakihousou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moktewsfgt.in (Spyware)"; content:"|0a|moktewsfgt|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mossad-torg.ru ()"; content:"|0b|mossad-torg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msk-edros2011.ru ()"; content:"|0d|msk-edros2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mspqprntosnavemw.biz (Malware_Distribution)"; content:"|10|mspqprntosnavemw|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediamoresoft.com (Malware_Distribution)"; content:"|12|multimediamoresoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup narten-art.com (Phishing_and_Theft)"; content:"|0a|narten-art|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nartenart.net (Phishing_and_Theft)"; content:"|09|nartenart|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nestpac.org (Phishing_and_Theft)"; content:"|07|nestpac|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neutronstats.com (Phishing_and_Theft)"; content:"|0c|neutronstats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newflashmedia.net (Malware_Distribution)"; content:"|0d|newflashmedia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpluginsflash.net (Malware_Distribution)"; content:"|0f|newpluginsflash|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niamax-ltd.com (Phishing_and_Theft)"; content:"|0a|niamax-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nmcunfvhmgonnlpc.com (Malware_Distribution)"; content:"|10|nmcunfvhmgonnlpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nrttktvksltrthqt.com (Malware_Distribution)"; content:"|10|nrttktvksltrthqt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nylujusofo.com (Spyware)"; content:"|0a|nylujusofo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officesupportrecruit.com (Phishing_and_Theft)"; content:"|14|officesupportrecruit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialpdf-download.com (Malware_Distribution)"; content:"|14|officialpdf-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialpdf-pro.com (Malware_Distribution)"; content:"|0f|officialpdf-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialssncard.org (Malware_Distribution)"; content:"|0f|officialssncard|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officialusgrantmoney.org (Malware_Distribution)"; content:"|14|officialusgrantmoney|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetvreport.com (Malware_Distribution)"; content:"|0e|onlinetvreport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetvreports.com (Malware_Distribution)"; content:"|0f|onlinetvreports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opinion-cash.com (Malware_Distribution)"; content:"|0c|opinion-cash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opqzwhoeobmphvm.info (Malware_Distribution)"; content:"|0f|opqzwhoeobmphvm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oulmfqvurontqrq.info (Malware_Distribution)"; content:"|0f|oulmfqvurontqrq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ozihspwvewnpeslp.com (Malware_Distribution)"; content:"|10|ozihspwvewnpeslp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patex.org ()"; content:"|05|patex|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peroillion.com (Spyware)"; content:"|0a|peroillion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phoenixsoftware.biz (Malware_Distribution)"; content:"|0f|phoenixsoftware|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup physx-software.biz (Malware_Distribution)"; content:"|0e|physx-software|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pixelbombers.com (Phishing_and_Theft)"; content:"|0c|pixelbombers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjttykfpqxyjwppx.com (Malware_Distribution)"; content:"|10|pjttykfpqxyjwppx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pleasefixthisapple.com (Phishing_and_Theft)"; content:"|12|pleasefixthisapple|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prabrahman-center.in ()"; content:"|11|prabrahman-center|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptmvkqnoplotujva.net (Malware_Distribution)"; content:"|10|ptmvkqnoplotujva|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puttvtuosdrifumn.org (Malware_Distribution)"; content:"|10|puttvtuosdrifumn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qajivehucewupo.com (Spyware)"; content:"|0e|qajivehucewupo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qmqonnuorpyvjxo.com (Malware_Distribution)"; content:"|0f|qmqonnuorpyvjxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqnvtkosnhspkyol.info (Malware_Distribution)"; content:"|10|qqnvtkosnhspkyol|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqsoqqnfigxlde.org (Malware_Distribution)"; content:"|0e|qqsoqqnfigxlde|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ralexezoj.com (Spyware)"; content:"|09|ralexezoj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rcmediapartners.com (Phishing_and_Theft)"; content:"|0f|rcmediapartners|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recruiterlogix.net (Phishing_and_Theft)"; content:"|0e|recruiterlogix|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recruitron.com (Phishing_and_Theft)"; content:"|0a|recruitron|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recrutingdynamics.com (Phishing_and_Theft)"; content:"|11|recrutingdynamics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redrecordz.com (Malware_Distribution)"; content:"|0a|redrecordz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refinement-antique.com (Phishing_and_Theft)"; content:"|12|refinement-antique|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refinementuk-ltd.net (Phishing_and_Theft)"; content:"|10|refinementuk-ltd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rekroot.netretreev.us (Phishing_and_Theft)"; content:"|07|rekroot|0a|netretreev|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rexiqarifotoq.com (Spyware)"; content:"|0d|rexiqarifotoq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rmobbine.com ()"; content:"|08|rmobbine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rockstarmarketing.com (Phishing_and_Theft)"; content:"|11|rockstarmarketing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rockyourgame.com (Phishing_and_Theft)"; content:"|0c|rockyourgame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rupscuqtmrjyoghz.info (Malware_Distribution)"; content:"|10|rupscuqtmrjyoghz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rwvkuliorpvijkr.net (Malware_Distribution)"; content:"|0f|rwvkuliorpvijkr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sgimgmuppzpgyqib.com (Malware_Distribution)"; content:"|10|sgimgmuppzpgyqib|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup splinterview.com (Phishing_and_Theft)"; content:"|0c|splinterview|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suite-3.org (Malware_Distribution)"; content:"|07|suite-3|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suite-download.org (Malware_Distribution)"; content:"|0e|suite-download|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumuryvynuh.com (Spyware)"; content:"|0b|sumuryvynuh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-bowl-championship.com (Malware_Distribution)"; content:"|17|super-bowl-championship|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup svefipuj.cn (Malware_Distribution)"; content:"|08|svefipuj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup svyasadde.com (Malware_Distribution)"; content:"|09|svyasadde|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-software.biz (Malware_Distribution)"; content:"|0f|system-software|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemcarefreedownload.com (Malware_Distribution)"; content:"|16|systemcarefreedownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup talentbase.us (Phishing_and_Theft)"; content:"|0a|talentbase|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tbegicoz.cn (Malware_Distribution)"; content:"|08|tbegicoz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tercihdunyasi.com (Malware_Distribution)"; content:"|0d|tercihdunyasi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-best-download-place.com (Malware_Distribution)"; content:"|17|the-best-download-place|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-movie-downloading.com (Malware_Distribution)"; content:"|15|the-movie-downloading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-moviecenter.com (Malware_Distribution)"; content:"|0f|the-moviecenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-moviesdownload.com (Malware_Distribution)"; content:"|12|the-moviesdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-show-stopper.com (Malware_Distribution)"; content:"|10|the-show-stopper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tixirukemosa.com (Spyware)"; content:"|0c|tixirukemosa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todex-group.net (Phishing_and_Theft)"; content:"|0b|todex-group|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tqicowoskgkpee.org (Malware_Distribution)"; content:"|0e|tqicowoskgkpee|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usciro.com (Spyware)"; content:"|06|usciro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usmedicalbiller.com (Phishing_and_Theft)"; content:"|0f|usmedicalbiller|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vqnrtqtvindysk.org (Malware_Distribution)"; content:"|0e|vqnrtqtvindysk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vyqivaneh.com (Spyware)"; content:"|09|vyqivaneh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waliwetixybuk.com (Spyware)"; content:"|0d|waliwetixybuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warehouserecruiter.com (Phishing_and_Theft)"; content:"|12|warehouserecruiter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve0.com (Malware_Distribution)"; content:"|08|wnlseve0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve1.com (Malware_Distribution)"; content:"|08|wnlseve1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve2.com (Malware_Distribution)"; content:"|08|wnlseve2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve3.com (Malware_Distribution)"; content:"|08|wnlseve3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve4.com (Malware_Distribution)"; content:"|08|wnlseve4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve5.com (Malware_Distribution)"; content:"|08|wnlseve5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve6.com (Malware_Distribution)"; content:"|08|wnlseve6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve7.com (Malware_Distribution)"; content:"|08|wnlseve7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve8.com (Malware_Distribution)"; content:"|08|wnlseve8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlseve9.com (Malware_Distribution)"; content:"|08|wnlseve9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup workforneutron.com (Phishing_and_Theft)"; content:"|0e|workforneutron|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wowwwjtuqrrwqxhs.com (Malware_Distribution)"; content:"|10|wowwwjtuqrrwqxhs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wyduzylys.com (Spyware)"; content:"|09|wyduzylys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xalybaron.com (Spyware)"; content:"|09|xalybaron|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyvenuvewa.com (Spyware)"; content:"|0a|xyvenuvewa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhrrnpxusxsvtowm.info (Malware_Distribution)"; content:"|10|yhrrnpxusxsvtowm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yipqejoluqetvwtj.org (Malware_Distribution)"; content:"|10|yipqejoluqetvwtj|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ylklxatyuurqrkln.com (Malware_Distribution)"; content:"|10|ylklxatyuurqrkln|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yrelsnxddpcuprxm.info (Malware_Distribution)"; content:"|10|yrelsnxddpcuprxm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ywleoxklqpkptlmk.com (Malware_Distribution)"; content:"|10|ywleoxklqpkptlmk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zypomamuzosa.com (Spyware)"; content:"|0c|zypomamuzosa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aremosgooo.co.cc (Malware_Distribution)"; content:"|0a|aremosgooo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancedwebanalytic.com (Malware_Distribution)"; content:"|13|advancedwebanalytic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruswala.com (Fake_AV)"; content:"|0d|antiviruswala|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bij.pl (Malware_Distribution)"; content:"|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maislex.net (Malware_Distribution)"; content:"|07|maislex|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recover888.com (Malware_Distribution)"; content:"|0a|recover888|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abodeflashdown.co.cc (Malware_Distribution)"; content:"|0e|abodeflashdown|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accessgrantegood.com (Malware_Infectors)"; content:"|10|accessgrantegood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accessgrantegood.net (Malware_Distribution)"; content:"|10|accessgrantegood|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accessgrantegood.org (Malware_Distribution)"; content:"|10|accessgrantegood|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup additionalprofit.ru (Malware_Infectors)"; content:"|10|additionalprofit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adksv7nuj.net (Malware_Infectors)"; content:"|09|adksv7nuj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobedloadx.com (Spyware)"; content:"|0b|adobedloadx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghiszfaoxk.com (Malware_Infectors)"; content:"|0b|aghiszfaoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auberon.com.sg (Malware_Distribution)"; content:"|07|auberon|03|com|02|sg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bada888.com (Spyware)"; content:"|07|bada888|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz105news.com ()"; content:"|0a|biz105news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz106news.com ()"; content:"|0a|biz106news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz107news.com ()"; content:"|0a|biz107news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz108news.com ()"; content:"|0a|biz108news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz109news.com ()"; content:"|0a|biz109news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz10news.ru ()"; content:"|09|biz10news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz110news.com ()"; content:"|0a|biz110news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz111news.com ()"; content:"|0a|biz111news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz111news.ru ()"; content:"|0a|biz111news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz112news.com ()"; content:"|0a|biz112news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz113news.com ()"; content:"|0a|biz113news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz114news.com ()"; content:"|0a|biz114news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz115news.com ()"; content:"|0a|biz115news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz116news.com ()"; content:"|0a|biz116news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz117news.com ()"; content:"|0a|biz117news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz118news.com ()"; content:"|0a|biz118news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz119news.com ()"; content:"|0a|biz119news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blenulin.in (Malware_Distribution)"; content:"|08|blenulin|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogging.fileave.com (Malware_Distribution)"; content:"|08|blogging|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cikipihigilani.com (Spyware)"; content:"|0e|cikipihigilani|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearagent.ru (Malware_Infectors)"; content:"|0a|clearagent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creativeecodrive.com (Malware_Distribution)"; content:"|10|creativeecodrive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuhucupivu.com (Spyware)"; content:"|0a|cuhucupivu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deltatank77.com (Malware_Distribution)"; content:"|0b|deltatank77|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demolish.com.hk (Spyware)"; content:"|08|demolish|03|com|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgksynnuj.net (Malware_Infectors)"; content:"|09|dgksynnuj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup face-apple.ru (Malware_Infectors)"; content:"|0a|face-apple|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanoduwyhu.com (Spyware)"; content:"|0a|fanoduwyhu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fightagent.ru (Malware_Infectors)"; content:"|0a|fightagent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-openservice.com (Malware_Distribution)"; content:"|10|free-openservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fxlxonpng.co.tv (Malware_Distribution)"; content:"|09|fxlxonpng|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gakenofod.com (Spyware)"; content:"|09|gakenofod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gjbbyyc.com (Malware_Distribution)"; content:"|07|gjbbyyc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdxxxvideoonline.com (Malware_Distribution)"; content:"|10|hdxxxvideoonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgksdgluj.net (Malware_Infectors)"; content:"|09|hgksdgluj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iir.nccu.edu.tw (Spyware)"; content:"|03|iir|04|nccu|03|edu|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img1.theappl.co (Spyware)"; content:"|04|img1|07|theappl|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaiv.kz (Malware_Distribution)"; content:"|04|kaiv|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mabxcqtmoxk.com (Malware_Infectors)"; content:"|0b|mabxcqtmoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamugah.org (Malware_Distribution)"; content:"|07|mamugah|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marcusschaefer.de (Malware_Distribution)"; content:"|0e|marcusschaefer|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mfziynuj.biz (Malware_Infectors)"; content:"|08|mfziynuj|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modularpoint.com (Malware_Distribution)"; content:"|0c|modularpoint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspacegorsio.com (Malware_Distribution)"; content:"|0d|myspacegorsio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ninjafy.com (Malware_Distribution)"; content:"|07|ninjafy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-pro-2010.com (Malware_Distribution)"; content:"|0c|pdf-pro-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-pro-edition.com (Malware_Distribution)"; content:"|0f|pdf-pro-edition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-pro2010.com (Malware_Distribution)"; content:"|0b|pdf-pro2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-pro2011.com (Malware_Distribution)"; content:"|0b|pdf-pro2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-reader--2010.com (Malware_Distribution)"; content:"|10|pdf-reader--2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-reader-online.com (Malware_Distribution)"; content:"|11|pdf-reader-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf10pro-download.com (Malware_Distribution)"; content:"|11|pdf10pro-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf9-download.com (Malware_Distribution)"; content:"|0d|pdf9-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf9pro-download.com (Malware_Distribution)"; content:"|10|pdf9pro-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdfdownload-new.com (Malware_Distribution)"; content:"|0f|pdfdownload-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdfnewdownload.com (Malware_Distribution)"; content:"|0e|pdfnewdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdfprodownload.com (Malware_Distribution)"; content:"|0e|pdfprodownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdfreader--2010.com (Malware_Distribution)"; content:"|0f|pdfreader--2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pegabafifid.com (Spyware)"; content:"|0b|pegabafifid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pennystockguru200.ru ()"; content:"|11|pennystockguru200|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pennystockguru202.ru ()"; content:"|11|pennystockguru202|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pennystockguru204.ru ()"; content:"|11|pennystockguru204|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pennystockpicks200.ru ()"; content:"|12|pennystockpicks200|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pennystockpicks202.ru ()"; content:"|12|pennystockpicks202|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pennystockpicks203.ru ()"; content:"|12|pennystockpicks203|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pennystockpicks204.ru ()"; content:"|12|pennystockpicks204|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peqokasyzato.com (Spyware)"; content:"|0c|peqokasyzato|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoscape2009.com (Malware_Distribution)"; content:"|0e|photoscape2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pifajeniwyt.com (Spyware)"; content:"|0b|pifajeniwyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup platinumsurveys-online.com (Malware_Distribution)"; content:"|16|platinumsurveys-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-2010-downloads.com (Malware_Distribution)"; content:"|15|player-2010-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-2010-new.com (Malware_Distribution)"; content:"|0f|player-2010-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-2010.com (Malware_Distribution)"; content:"|0b|player-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-download-2010.com (Malware_Distribution)"; content:"|14|player-download-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-download-new.com (Malware_Distribution)"; content:"|13|player-download-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-downloads-now.com (Malware_Distribution)"; content:"|14|player-downloads-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup power-update.ru (Malware_Infectors)"; content:"|0c|power-update|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup purchase-gateway.com (Malware_Distribution)"; content:"|10|purchase-gateway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup purumpumpum.co.cc (Malware_Distribution)"; content:"|0b|purumpumpum|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qhjkyrgqoxk.com (Malware_Infectors)"; content:"|0b|qhjkyrgqoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qiamlfjqoxk.com (Malware_Infectors)"; content:"|0b|qiamlfjqoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjksmynuj.net (Malware_Infectors)"; content:"|09|qjksmynuj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qmesanic.cn (Malware_Distribution)"; content:"|08|qmesanic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qtorifik.cn (Malware_Distribution)"; content:"|08|qtorifik|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick-cashblog.com (Malware_Distribution)"; content:"|0e|quick-cashblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick-free-movie.com (Malware_Distribution)"; content:"|10|quick-free-movie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radososaxuw.com (Spyware)"; content:"|0b|radososaxuw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raxukakudumow.com (Spyware)"; content:"|0d|raxukakudumow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ridibasofetevi.com (Spyware)"; content:"|0e|ridibasofetevi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rifynefusawi.com (Spyware)"; content:"|0c|rifynefusawi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ritywosex.com (Spyware)"; content:"|09|ritywosex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rizinojopop.com (Spyware)"; content:"|0b|rizinojopop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roboralipijago.com (Spyware)"; content:"|0e|roboralipijago|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rohyjikyf.com (Spyware)"; content:"|09|rohyjikyf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rokyhepym.com (Spyware)"; content:"|09|rokyhepym|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ropunonic.com (Spyware)"; content:"|09|ropunonic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruhadocywyty.com (Spyware)"; content:"|0c|ruhadocywyty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rumesexyzobuz.com (Spyware)"; content:"|0d|rumesexyzobuz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup runufihibijy.com (Spyware)"; content:"|0c|runufihibijy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruqidehecyty.com (Spyware)"; content:"|0c|ruqidehecyty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rurypexojis.com (Spyware)"; content:"|0b|rurypexojis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rygemakub.com (Spyware)"; content:"|09|rygemakub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryqixafumigeqe.com (Spyware)"; content:"|0e|ryqixafumigeqe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryranatapum.com (Spyware)"; content:"|0b|ryranatapum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sabdhcysoxk.com (Malware_Infectors)"; content:"|0b|sabdhcysoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanguards.com (Spyware)"; content:"|0a|scanguards|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchdestroypro.com (Malware_Distribution)"; content:"|10|searchdestroypro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-signup-online.ru (Malware_Distribution)"; content:"|14|secure-signup-online|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-antivirussite.com (Fake_AV)"; content:"|16|security-antivirussite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sefrqonsoxk.com (Malware_Infectors)"; content:"|0b|sefrqonsoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup silkarn.com (Malware_Infectors)"; content:"|07|silkarn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sirakapofeti.com (Spyware)"; content:"|0c|sirakapofeti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjimilah.cn (Malware_Distribution)"; content:"|08|sjimilah|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smoxewac.cn (Malware_Distribution)"; content:"|08|smoxewac|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sovi.tw (Malware_Distribution)"; content:"|04|sovi|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sports-membersarea.com (Malware_Distribution)"; content:"|12|sports-membersarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sports-online-networks.com (Malware_Distribution)"; content:"|16|sports-online-networks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sports-online-tv.com (Malware_Distribution)"; content:"|10|sports-online-tv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportstvreview.com (Malware_Distribution)"; content:"|0e|sportstvreview|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spybot-remover.com (Malware_Distribution)"; content:"|0e|spybot-remover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssesodoq.cn (Malware_Distribution)"; content:"|08|ssesodoq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssncardonline.org (Malware_Distribution)"; content:"|0d|ssncardonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stimul-media.com (Malware_Infectors)"; content:"|0c|stimul-media|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syntaxswitch.ru (Malware_Infectors)"; content:"|0c|syntaxswitch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taobao.lylwc.com (Malware_Distribution)"; content:"|06|taobao|05|lylwc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tcho.co.kr (Spyware)"; content:"|04|tcho|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tckspknuj.net (Malware_Infectors)"; content:"|09|tckspknuj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teamtrk.us (Spyware)"; content:"|07|teamtrk|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tijusenenoqije.com (Spyware)"; content:"|0e|tijusenenoqije|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolbarqeries-google.com (Zeus_Zbot_SpyEye)"; content:"|14|toolbarqeries-google|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tqyrf6jgsgs.info (Malware_Infectors)"; content:"|0b|tqyrf6jgsgs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuwynaropotit.com (Spyware)"; content:"|0d|tuwynaropotit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unallocated41.coverhosting.ro (Malware_Distribution)"; content:"|0d|unallocated41|0c|coverhosting|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vietnampig.com (Spyware)"; content:"|0a|vietnampig|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webimg.a3box.co.kr (Spyware)"; content:"|06|webimg|05|a3box|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup window-switch.ru (Malware_Infectors)"; content:"|0d|window-switch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wipkegfiew.org (Malware_Distribution)"; content:"|0a|wipkegfiew|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wyuwgj2v2v.info (Malware_Infectors)"; content:"|0a|wyuwgj2v2v|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xelihuneri.com (Spyware)"; content:"|0a|xelihuneri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zenevakyfa.com (Spyware)"; content:"|0a|zenevakyfa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziketudyd.com (Spyware)"; content:"|09|ziketudyd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visitorseerdt.co.cc (Malware_Distribution)"; content:"|0d|visitorseerdt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup africabusinessintelligence.com (Malware_Distribution)"; content:"|1a|africabusinessintelligence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup altogiro.ind.br (Malware_Distribution)"; content:"|08|altogiro|03|ind|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnbutterfly.com (Malware_Distribution)"; content:"|0b|cnbutterfly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jiayifan.cn (Malware_Distribution)"; content:"|08|jiayifan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcclear.com (Spyware)"; content:"|07|pcclear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puertoplatarental.com (Malware_Distribution)"; content:"|11|puertoplatarental|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qutped.com (Malware_Distribution)"; content:"|06|qutped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yujinshan.cn (Malware_Distribution)"; content:"|09|yujinshan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup active-prosecurity.com (Spyware)"; content:"|12|active-prosecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activebroom.com (Spyware)"; content:"|0b|activebroom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activeguardpro.com (Spyware)"; content:"|0e|activeguardpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activesecuritypro.com (Spyware)"; content:"|11|activesecuritypro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-celebrities-exposed.com (Malware_Distribution)"; content:"|17|all-celebrities-exposed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antisorit.cn.com (Zeus_Zbot_SpyEye)"; content:"|09|antisorit|02|cn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-pack.ce.ms (Fake_AV)"; content:"|0e|antivirus-pack|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusedition.com (Fake_AV)"; content:"|10|antivirusedition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqiruwim.com (Spyware)"; content:"|08|aqiruwim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badodybeqyk.com (Spyware)"; content:"|0b|badodybeqyk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beatriceinfo.com (Phishing_and_Theft)"; content:"|0c|beatriceinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestprivacycleaner.com (Malware_Distribution)"; content:"|12|bestprivacycleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billten.net (Malware_Infectors)"; content:"|07|billten|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-vozrast.ru (Malware_Distribution)"; content:"|0b|bio-vozrast|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz100flash.ru ()"; content:"|0b|biz100flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz100news.com ()"; content:"|0a|biz100news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz101flash.ru ()"; content:"|0b|biz101flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz101news.com ()"; content:"|0a|biz101news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz101news.ru ()"; content:"|0a|biz101news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz102flash.ru ()"; content:"|0b|biz102flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz102news.com ()"; content:"|0a|biz102news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz103flash.ru ()"; content:"|0b|biz103flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz103news.com ()"; content:"|0a|biz103news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz104flash.ru ()"; content:"|0b|biz104flash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz104news.com ()"; content:"|0a|biz104news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz11flash.com ()"; content:"|0a|biz11flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz11news.ru ()"; content:"|09|biz11news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz120news.com ()"; content:"|0a|biz120news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz121news.ru ()"; content:"|0a|biz121news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz12flash.com ()"; content:"|0a|biz12flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz12news.ru ()"; content:"|09|biz12news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz131news.ru ()"; content:"|0a|biz131news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz13flash.com ()"; content:"|0a|biz13flash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz13news.ru ()"; content:"|09|biz13news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bocikivihepiqa.com (Spyware)"; content:"|0e|bocikivihepiqa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bogemasecurity.com (Spyware)"; content:"|0e|bogemasecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bosuwiqexise.com (Spyware)"; content:"|0c|bosuwiqexise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup broomscan.com (Spyware)"; content:"|09|broomscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bsdfgradehhha.tld.tc (Malware_Infectors)"; content:"|0d|bsdfgradehhha|03|tld|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bucyguwored.com (Spyware)"; content:"|0b|bucyguwored|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bumucewafypevy.com (Spyware)"; content:"|0e|bumucewafypevy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-broom.com (Spyware)"; content:"|0b|clean-broom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanguard2011.com (Spyware)"; content:"|0e|cleanguard2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickgrandrapids.org (Malware_Infectors)"; content:"|10|clickgrandrapids|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ctive-prosecurity.com (Spyware)"; content:"|11|ctive-prosecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyjdyawertyaery.tld.tc (Malware_Infectors)"; content:"|0f|cyjdyawertyaery|03|tld|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dabuvusato.com (Spyware)"; content:"|0a|dabuvusato|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dev-facebook.com (Malware_Distribution)"; content:"|0c|dev-facebook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolagomosu.com (Spyware)"; content:"|0a|dolagomosu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dubacobimude.com (Spyware)"; content:"|0c|dubacobimude|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dytilicojame.com (Spyware)"; content:"|0c|dytilicojame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easypccleaner.net (Spyware)"; content:"|0d|easypccleaner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup efidaxamo.com (Spyware)"; content:"|09|efidaxamo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enukunaziha.com (Spyware)"; content:"|0b|enukunaziha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eqezifebawe.com (Spyware)"; content:"|0b|eqezifebawe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esvkontakte.elj.cc (Phishing_and_Theft)"; content:"|0b|esvkontakte|03|elj|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faremewumasebe.com (Spyware)"; content:"|0e|faremewumasebe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faxilujome.com (Spyware)"; content:"|0a|faxilujome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gihunoholo.com (Spyware)"; content:"|0a|gihunoholo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gikupilah.com (Spyware)"; content:"|09|gikupilah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenhopengo.com (Malware_Distribution)"; content:"|0c|greenhopengo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guqirfxl.ce.ms (Spyware)"; content:"|08|guqirfxl|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hamobamaduro.com (Spyware)"; content:"|0c|hamobamaduro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hepekekejepuvo.com (Spyware)"; content:"|0e|hepekekejepuvo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hepotevena.com (Spyware)"; content:"|0a|hepotevena|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herovidacege.com (Spyware)"; content:"|0c|herovidacege|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homegroupmovie.com (Malware_Infectors)"; content:"|0e|homegroupmovie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugepcsecurity.com (Spyware)"; content:"|0e|hugepcsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup husrylkxfp.ru (Malware_Distribution)"; content:"|0a|husrylkxfp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibyfolyzijym.com (Spyware)"; content:"|0c|ibyfolyzijym|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idanimujypiq.com (Spyware)"; content:"|0c|idanimujypiq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idddddausdfg.co.be (Malware_Infectors)"; content:"|0c|idddddausdfg|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igotiroda.com (Spyware)"; content:"|09|igotiroda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ineedinface.net (Zeus_Zbot_SpyEye)"; content:"|0b|ineedinface|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jicylegavade.com (Spyware)"; content:"|0c|jicylegavade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johigijito.com (Zeus_Zbot_SpyEye)"; content:"|0a|johigijito|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jotomumehyn.com (Spyware)"; content:"|0b|jotomumehyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jymepidesipe.com (Spyware)"; content:"|0c|jymepidesipe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyviziwopakisy.com (Spyware)"; content:"|0e|jyviziwopakisy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolifixewitiq.com (Spyware)"; content:"|0d|kolifixewitiq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kovebesovurobo.com (Spyware)"; content:"|0e|kovebesovurobo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kurinyfybex.com (Spyware)"; content:"|0b|kurinyfybex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lajogitytudaxo.com (Spyware)"; content:"|0e|lajogitytudaxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lerizesax.com (Spyware)"; content:"|09|lerizesax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litepcsecurity.com (Spyware)"; content:"|0e|litepcsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lucuhojivinu.com (Spyware)"; content:"|0c|lucuhojivinu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lungscanxpprotectionnow.com (Spyware)"; content:"|17|lungscanxpprotectionnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mailenable-antivirus.ce.ms (Fake_AV)"; content:"|14|mailenable-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-defender.com (Spyware)"; content:"|10|malware-defender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup many-housefile.ru (Malware_Distribution)"; content:"|0e|many-housefile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediawork.com (Spyware)"; content:"|09|mediawork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mefanecafucy.com (Spyware)"; content:"|0c|mefanecafucy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megapccleaner.com (Malware_Distribution)"; content:"|0d|megapccleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaprobroom.com (Spyware)"; content:"|0c|megaprobroom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasecurityguard.com (Spyware)"; content:"|11|megasecurityguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mehyqibugyluf.com (Spyware)"; content:"|0d|mehyqibugyluf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mejor-antivirus.ce.ms (Fake_AV)"; content:"|0f|mejor-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microtrends-antivirus.ce.ms (Fake_AV)"; content:"|15|microtrends-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microunlim.com (Spyware)"; content:"|0a|microunlim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mikrotik-antivirus.ce.ms (Fake_AV)"; content:"|12|mikrotik-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviezdir.com (Spyware)"; content:"|09|moviezdir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multiscanpro.com (Spyware)"; content:"|0c|multiscanpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multithreaded-antivirus.ce.ms (Fake_AV)"; content:"|17|multithreaded-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysteryforyou1.ru (Malware_Distribution)"; content:"|0e|mysteryforyou1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysupigaqyme.com (Spyware)"; content:"|0c|mysupigaqyme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nav-antivirus.ce.ms (Fake_AV)"; content:"|0d|nav-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netymyzevibe.com (Spyware)"; content:"|0c|netymyzevibe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nih-antivirus.ce.ms (Fake_AV)"; content:"|0d|nih-antivirus|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nobimopizijy.com (Spyware)"; content:"|0c|nobimopizijy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt20.in (Malware_Distribution)"; content:"|04|nt20|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opensoftupdate.com (Malware_Distribution)"; content:"|0e|opensoftupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oposumcruiser.com (Zeus_Zbot_SpyEye)"; content:"|0d|oposumcruiser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ourosobreazul.net (Malware_Distribution)"; content:"|0d|ourosobreazul|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outped.com (Malware_Distribution)"; content:"|06|outped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overload-yourconsole.com (Malware_Distribution)"; content:"|14|overload-yourconsole|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pahebebici.com (Spyware)"; content:"|0a|pahebebici|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pakakywuseleri.com (Spyware)"; content:"|0e|pakakywuseleri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panomanih.com (Spyware)"; content:"|09|panomanih|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parnik.ir (Malware_Distribution)"; content:"|06|parnik|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pbigupaz.cn (Malware_Distribution)"; content:"|08|pbigupaz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pccleaning.biz (Malware_Distribution)"; content:"|0a|pccleaning|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcprodefender.com (Spyware)"; content:"|0d|pcprodefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pctool-sale.com (Malware_Distribution)"; content:"|0b|pctool-sale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-2010-download.com (Malware_Distribution)"; content:"|11|pdf-2010-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-2010.com (Malware_Distribution)"; content:"|08|pdf-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-9-d0wnload.com (Malware_Distribution)"; content:"|0e|pdf-9-d0wnload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-new-2010-download.com (Malware_Distribution)"; content:"|15|pdf-new-2010-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-new-version.com (Malware_Distribution)"; content:"|0f|pdf-new-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-new2010.com (Malware_Distribution)"; content:"|0b|pdf-new2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfectcheck2011.com (Zeus_Zbot_SpyEye)"; content:"|10|perfectcheck2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-guard.com (Spyware)"; content:"|0e|personal-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pivysegocide.com (Spyware)"; content:"|0c|pivysegocide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-new-version.com (Malware_Distribution)"; content:"|12|player-new-version|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-pro-download.com (Malware_Distribution)"; content:"|13|player-pro-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-telechargement.com (Malware_Distribution)"; content:"|15|player-telechargement|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playerfreedownload.com (Malware_Distribution)"; content:"|12|playerfreedownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playoffs-live-online.com (Malware_Distribution)"; content:"|14|playoffs-live-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poisk-getall.ru (Malware_Distribution)"; content:"|0c|poisk-getall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerwaterforcar.com (Malware_Distribution)"; content:"|10|powerwaterforcar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premium-support-2011.com (Spyware)"; content:"|14|premium-support-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premium-tattoo-design.com (Malware_Distribution)"; content:"|15|premium-tattoo-design|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premiumsupport2011.com (Spyware)"; content:"|12|premiumsupport2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pro-mediaplayer.com (Malware_Distribution)"; content:"|0f|pro-mediaplayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profiles-doscaner.tk (Malware_Distribution)"; content:"|11|profiles-doscaner|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profit-forex-market.com (Malware_Distribution)"; content:"|13|profit-forex-market|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pykolujij.com (Spyware)"; content:"|09|pykolujij|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qasxfstjtyk.tld.tc (Malware_Infectors)"; content:"|0b|qasxfstjtyk|03|tld|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qdrthytkjsdhy.tld.tc (Malware_Infectors)"; content:"|0d|qdrthytkjsdhy|03|tld|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qebamyvawa.com (Spyware)"; content:"|0a|qebamyvawa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlpmpclt.ce.ms (Spyware)"; content:"|08|qlpmpclt|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qoxomyjomaj.com (Spyware)"; content:"|0b|qoxomyjomaj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qubmoviez.com (Spyware)"; content:"|09|qubmoviez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qusocumugoto.com (Spyware)"; content:"|0c|qusocumugoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quxynyneby.com (Spyware)"; content:"|0a|quxynyneby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qyciborus.com (Spyware)"; content:"|09|qyciborus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qypyzonuhy.com (Spyware)"; content:"|0a|qypyzonuhy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rytaxywika.com (Spyware)"; content:"|0a|rytaxywika|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sacunifupacamy.com (Malware_Infectors)"; content:"|0e|sacunifupacamy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sconvert.com (Spyware)"; content:"|08|sconvert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securebis.net (Spyware)"; content:"|09|securebis|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sekpayer.com (Spyware)"; content:"|08|sekpayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sekupayer.com (Spyware)"; content:"|09|sekupayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sipunapapavi.com (Spyware)"; content:"|0c|sipunapapavi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjkkkudafasdf.tld.tc (Malware_Infectors)"; content:"|0d|sjkkkudafasdf|03|tld|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sopyqatuc.com (Spyware)"; content:"|09|sopyqatuc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stopfraudnow.org (Malware_Infectors)"; content:"|0c|stopfraudnow|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stopfraudonline.net (Malware_Infectors)"; content:"|0f|stopfraudonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stream-and-watch.com (Malware_Distribution)"; content:"|10|stream-and-watch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stream-direct-online.com (Malware_Distribution)"; content:"|14|stream-direct-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stream-direct.com (Malware_Distribution)"; content:"|0d|stream-direct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stream-new-movies.com (Malware_Distribution)"; content:"|11|stream-new-movies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stream-onlinemovies.com (Malware_Distribution)"; content:"|13|stream-onlinemovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamdirect-movies.com (Malware_Distribution)"; content:"|13|streamdirect-movies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamdirect-music.com (Malware_Distribution)"; content:"|12|streamdirect-music|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamdirect-sports.com (Malware_Distribution)"; content:"|13|streamdirect-sports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamdirect-tv.com (Malware_Distribution)"; content:"|0f|streamdirect-tv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamdirect-tvpc.com (Malware_Distribution)"; content:"|11|streamdirect-tvpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamdirect.tv (Malware_Distribution)"; content:"|0c|streamdirect|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamdirectmovies.com (Malware_Distribution)"; content:"|12|streamdirectmovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamdirecttv.com (Malware_Distribution)"; content:"|0e|streamdirecttv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamdirecttvpc.com (Malware_Distribution)"; content:"|10|streamdirecttvpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamlive-tv.com (Malware_Distribution)"; content:"|0d|streamlive-tv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamonline-movie.com (Malware_Distribution)"; content:"|12|streamonline-movie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suite-2010.com (Malware_Distribution)"; content:"|0a|suite-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supportservice-2012.com (Spyware)"; content:"|13|supportservice-2012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supportservice2012.com (Spyware)"; content:"|12|supportservice2012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tesonugixamys.com (Spyware)"; content:"|0d|tesonugixamys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tevisuwapucumu.com (Spyware)"; content:"|0e|tevisuwapucumu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup textilfabrique.com (Zeus_Zbot_SpyEye)"; content:"|0e|textilfabrique|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebest-mediaonline.com (Malware_Distribution)"; content:"|13|thebest-mediaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themovie-downloading.com (Malware_Distribution)"; content:"|14|themovie-downloading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themoviedownloads.com (Malware_Distribution)"; content:"|11|themoviedownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup therack-members.com (Malware_Distribution)"; content:"|0f|therack-members|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup therack-membersarea.com (Malware_Distribution)"; content:"|13|therack-membersarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup therack-transaction.com (Malware_Distribution)"; content:"|13|therack-transaction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theshowstopper-solution.com (Malware_Distribution)"; content:"|17|theshowstopper-solution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theweightloss-4beginners.com (Malware_Distribution)"; content:"|18|theweightloss-4beginners|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tivped.com (Malware_Distribution)"; content:"|06|tivped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torrentsez.com (Malware_Distribution)"; content:"|0a|torrentsez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torrentspro.com (Malware_Distribution)"; content:"|0b|torrentspro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup total-acne-treatments.com (Malware_Distribution)"; content:"|15|total-acne-treatments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube-downloader-download.com (Malware_Distribution)"; content:"|18|tube-downloader-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubitorrent.com (Malware_Distribution)"; content:"|0a|ubitorrent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ufc126live.com (Malware_Distribution)"; content:"|0a|ufc126live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimantispyware.com (Fake_AV)"; content:"|10|ultimantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimate-guard.com (Spyware)"; content:"|0e|ultimate-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimate-scan.com (Spyware)"; content:"|0d|ultimate-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimateofficesuites.com (Malware_Distribution)"; content:"|14|ultimateofficesuites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimdefender.com (Spyware)"; content:"|0d|unlimdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimguard.com (Spyware)"; content:"|0a|unlimguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlimited-protection.com (Spyware)"; content:"|14|unlimited-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utuhubolype.com (Spyware)"; content:"|0b|utuhubolype|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uxuvoxogy.com (Spyware)"; content:"|09|uxuvoxogy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uyxbxlex.ce.ms (Spyware)"; content:"|08|uyxbxlex|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vakatesumuhor.com (Spyware)"; content:"|0d|vakatesumuhor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vodijurupe.com (Spyware)"; content:"|0a|vodijurupe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuvamewakoq.com (Spyware)"; content:"|0b|vuvamewakoq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wamikopyzoqah.com (Spyware)"; content:"|0d|wamikopyzoqah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-pingfreeip.com (Malware_Infectors)"; content:"|0e|web-pingfreeip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wekabamysugamy.com (Spyware)"; content:"|0e|wekabamysugamy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-cleanpro.com (Spyware)"; content:"|0c|win-cleanpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winantimalwarepro.com (Fake_AV)"; content:"|11|winantimalwarepro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsdef.com (Spyware)"; content:"|0a|windowsdef|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsserversystemupdate.com (Malware_Distribution)"; content:"|19|windowsserversystemupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winmicroclean.com (Spyware)"; content:"|0d|winmicroclean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winproscan.com (Spyware)"; content:"|0a|winproscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winupdatesystem.com (Malware_Distribution)"; content:"|0f|winupdatesystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpkadvogados.com (Phishing_and_Theft)"; content:"|0c|wpkadvogados|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xaqygacatewuk.com (Spyware)"; content:"|0d|xaqygacatewuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xazofeberus.com (Spyware)"; content:"|0b|xazofeberus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xesopusacezeb.com (Spyware)"; content:"|0d|xesopusacezeb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xipagymofi.com (Spyware)"; content:"|0a|xipagymofi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--enyakn-t9a.com (Malware_Distribution)"; content:"|0e|xn--enyakn-t9a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ydijajyb.com (Spyware)"; content:"|08|ydijajyb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ygywiguxake.com (Spyware)"; content:"|0b|ygywiguxake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yjybocore.com (Spyware)"; content:"|09|yjybocore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ykilyxagesop.com (Spyware)"; content:"|0c|ykilyxagesop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ypyrezaba.com (Spyware)"; content:"|09|ypyrezaba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaxelasemijawo.com (Spyware)"; content:"|0e|zaxelasemijawo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zigitop.com (Spyware)"; content:"|07|zigitop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tportal.pl (Malware_Distribution)"; content:"|07|tportal|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutped.com (Malware_Distribution)"; content:"|06|cutped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 01n02n4cx00.com ()"; content:"|0b|01n02n4cx00|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 01n20n4cx00.com ()"; content:"|0b|01n20n4cx00|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 03med.in ()"; content:"|05|03med|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0five1.com ()"; content:"|06|0five1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0imh17agcla.com ()"; content:"|0b|0imh17agcla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 10n02n4cx00.com ()"; content:"|0b|10n02n4cx00|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12god3.net ()"; content:"|06|12god3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 16tonn.in ()"; content:"|06|16tonn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 17uhlsagsda.com (Malware_Distribution)"; content:"|0b|17uhlsagsda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1il1il1il.com ()"; content:"|09|1il1il1il|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1l1i16b0.com ()"; content:"|08|1l1i16b0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 23esdklfvb.com (Malware_Distribution)"; content:"|0a|23esdklfvb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2jg4jskhddd.com (Malware_Distribution)"; content:"|0b|2jg4jskhddd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2sos5.ru ()"; content:"|05|2sos5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3jshjhdwiye.com (Malware_Distribution)"; content:"|0b|3jshjhdwiye|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4gat16ag100.com ()"; content:"|0b|4gat16ag100|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4tag16ag100.com ()"; content:"|0b|4tag16ag100|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 68b6b6b6.com ()"; content:"|08|68b6b6b6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 69b69b6b96b.com ()"; content:"|0b|69b69b6b96b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6daytwtyg.com (Malware_Distribution)"; content:"|09|6daytwtyg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7gaur15eb71.com ()"; content:"|0b|7gaur15eb71|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7uagr15eb71.com ()"; content:"|0b|7uagr15eb71|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7uygwggdaus.com (Malware_Distribution)"; content:"|0b|7uygwggdaus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 86b6b6b6.com ()"; content:"|08|86b6b6b6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 86b6b96b.com ()"; content:"|08|86b6b96b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 95dass.org ()"; content:"|06|95dass|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9669b6b96b.com ()"; content:"|0a|9669b6b96b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdeubbamlc.com (Malware_Distribution)"; content:"|0b|acdeubbamlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdpeylaoxk.com (Malware_Distribution)"; content:"|0b|acdpeylaoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adfirmogroup.com (Malware_Distribution)"; content:"|0c|adfirmogroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin-vertigo2.uni.cc (Malware_Distribution)"; content:"|0e|admin-vertigo2|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghjpcfamlc.com (Malware_Distribution)"; content:"|0b|aghjpcfamlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahf3fa6yf.com (Malware_Distribution)"; content:"|09|ahf3fa6yf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahjpealaoxk.com (Malware_Distribution)"; content:"|0b|ahjpealaoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajiaaawamlc.com (Malware_Distribution)"; content:"|0b|ajiaaawamlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajikaahamlc.com (Malware_Distribution)"; content:"|0b|ajikaahamlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajiopqmavmr.com (Malware_Distribution)"; content:"|0b|ajiopqmavmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajiqkvmaoxk.com (Malware_Distribution)"; content:"|0b|ajiqkvmaoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajiuahramlc.com (Malware_Distribution)"; content:"|0b|ajiuahramlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajivpuraoxk.com (Malware_Distribution)"; content:"|0b|ajivpuraoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajt7utdgjstyh.com (Malware_Distribution)"; content:"|0d|ajt7utdgjstyh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajy3u6iugvjc.com (Malware_Distribution)"; content:"|0c|ajy3u6iugvjc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awesomebiz.co.cc ()"; content:"|0a|awesomebiz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beach-caroline9.uni.cc (Malware_Distribution)"; content:"|0f|beach-caroline9|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beryl-smother10.uni.cc (Malware_Distribution)"; content:"|0f|beryl-smother10|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bhjtueqbmlc.com (Malware_Distribution)"; content:"|0b|bhjtueqbmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bishoprosannah.ru (Spyware)"; content:"|0e|bishoprosannah|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bithygagarta7dm.dnsrd.com (Malware_Distribution)"; content:"|0f|bithygagarta7dm|05|dnsrd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boleslaw.ru (Malware_Infectors)"; content:"|08|boleslaw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cap01tchaa.com ()"; content:"|0a|cap01tchaa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cap0itchaa.com ()"; content:"|0a|cap0itchaa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbcenxacoxk.com (Malware_Distribution)"; content:"|0b|cbcenxacoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centersecurity.cx.cc (Malware_Infectors)"; content:"|0e|centersecurity|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheatsmaximal.net (Malware_Distribution)"; content:"|0d|cheatsmaximal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chemax.ru (Malware_Distribution)"; content:"|06|chemax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countri1l.com ()"; content:"|09|countri1l|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuminmouth9.com (Malware_Distribution)"; content:"|0b|cuminmouth9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curixycihig.com (Spyware)"; content:"|0b|curixycihig|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyprianus.ru ()"; content:"|09|cyprianus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dave-daemon9.uni.cc (Malware_Distribution)"; content:"|0c|dave-daemon9|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddefaccdmlc.com (Malware_Distribution)"; content:"|0b|ddefaccdmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dg6a51ja813.com ()"; content:"|0b|dg6a51ja813|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhj3ygg6g.com (Malware_Distribution)"; content:"|09|dhj3ygg6g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diavftsdmlc.com (Malware_Distribution)"; content:"|0b|diavftsdmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digestum.es (Malware_Distribution)"; content:"|08|digestum|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djkeyfhsfg5.com (Malware_Distribution)"; content:"|0b|djkeyfhsfg5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dutiducuwada.com (Spyware)"; content:"|0c|dutiducuwada|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e7tirafc4d.com (Malware_Distribution)"; content:"|0a|e7tirafc4d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ehjyurvemlc.com (Malware_Distribution)"; content:"|0b|ehjyurvemlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ejiuakremlc.com (Malware_Distribution)"; content:"|0b|ejiuakremlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyuhjvs2uh.com (Malware_Distribution)"; content:"|0a|eyuhjvs2uh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f1cd.ru (Malware_Distribution)"; content:"|04|f1cd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fbcnpikfmlc.com (Malware_Distribution)"; content:"|0b|fbcnpikfmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileuplarc.com (Botnet_C&C)"; content:"|0a|fileuplarc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fy3yyt3yfs.com (Malware_Distribution)"; content:"|0a|fy3yyt3yfs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gd6a15ja813.com ()"; content:"|0b|gd6a15ja813|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gfed5jgvxfj.com (Malware_Distribution)"; content:"|0b|gfed5jgvxfj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghjftbbgoxk.com (Malware_Distribution)"; content:"|0b|ghjftbbgoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghjoullgmlc.com (Malware_Distribution)"; content:"|0b|ghjoullgmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghwgy3thg.com (Malware_Distribution)"; content:"|09|ghwgy3thg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gisbert.ru (Spyware)"; content:"|07|gisbert|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gjigabcgoxk.com (Malware_Distribution)"; content:"|0b|gjigabcgoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gjivpergoxk.com (Malware_Distribution)"; content:"|0b|gjivpergoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorenmonszk.dynamicdns.biz (Malware_Distribution)"; content:"|0b|gorenmonszk|0a|dynamicdns|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gshg3ryshds.com (Malware_Distribution)"; content:"|0b|gshg3ryshds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsyt2h2fyd.com (Malware_Distribution)"; content:"|0a|gsyt2h2fyd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtregcztrf5.com (Malware_Distribution)"; content:"|0b|gtregcztrf5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiospdb3js.com (Malware_Distribution)"; content:"|0a|hiospdb3js|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjhrcgjbu6tf.com (Malware_Distribution)"; content:"|0c|hjhrcgjbu6tf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjsywuqjgvd2j.com (Malware_Distribution)"; content:"|0d|hjsywuqjgvd2j|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsuwt4yfdss.com (Malware_Distribution)"; content:"|0b|hsuwt4yfdss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsyiwkh2bjd.com (Malware_Distribution)"; content:"|0b|hsyiwkh2bjd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hunterdriveez.com (Botnet_C&C)"; content:"|0d|hunterdriveez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huwyu2jghfs.com (Malware_Distribution)"; content:"|0b|huwyu2jghfs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hwyuwhvev.com (Malware_Distribution)"; content:"|09|hwyuwhvev|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i0m71gmak01.com ()"; content:"|0b|i0m71gmak01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ideaazwimlc.com (Malware_Distribution)"; content:"|0b|ideaazwimlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifgwketimlc.com (Malware_Distribution)"; content:"|0b|ifgwketimlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikaturi11.com ()"; content:"|09|ikaturi11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagehut4.cn (Malware_Infectors)"; content:"|09|imagehut4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgfarm.com (Malware_Distribution)"; content:"|07|imgfarm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup incomeopps.co.cc ()"; content:"|0a|incomeopps|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indowebster.com (Malware_Distribution)"; content:"|0b|indowebster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innessphoto.com (Botnet_C&C)"; content:"|0b|innessphoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetmultimediaholding.com (Malware_Infectors)"; content:"|19|internetmultimediaholding|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iowpdjb2v4.com (Malware_Distribution)"; content:"|0a|iowpdjb2v4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabhkeejmlc.com (Malware_Distribution)"; content:"|0b|jabhkeejmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jdeqkemjoxk.com (Malware_Distribution)"; content:"|0b|jdeqkemjoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jeffdisthegulfpaxu.dumb1.com (Malware_Distribution)"; content:"|12|jeffdisthegulfpaxu|05|dumb1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jefhgmdjoxk.com (Malware_Distribution)"; content:"|0b|jefhgmdjoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jiqkjgjsd2.com (Malware_Distribution)"; content:"|0a|jiqkjgjsd2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjhgfrwsx5r.com (Malware_Distribution)"; content:"|0b|jjhgfrwsx5r|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jna0-0akq8x.com ()"; content:"|0b|jna0-0akq8x|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup josue.ru (Spyware)"; content:"|05|josue|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpeg1452.com (Malware_Infectors)"; content:"|08|jpeg1452|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juiwjdh72g.com (Malware_Distribution)"; content:"|0a|juiwjdh72g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juiwouhrbc.com (Malware_Distribution)"; content:"|0a|juiwouhrbc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ka18i7gah10.com ()"; content:"|0b|ka18i7gah10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kabjmqekoxk.com (Malware_Distribution)"; content:"|0b|kabjmqekoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kai817hag10.com ()"; content:"|0b|kai817hag10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kangojim1.com ()"; content:"|09|kangojim1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kangojjm1.com ()"; content:"|09|kangojjm1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kghspupkmlc.com (Malware_Distribution)"; content:"|0b|kghspupkmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kruokjdfb4.com (Malware_Distribution)"; content:"|0a|kruokjdfb4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kur1k0nona.com ()"; content:"|0a|kur1k0nona|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l04undreyk.com ()"; content:"|0a|l04undreyk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup li1i16b0.com ()"; content:"|08|li1i16b0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liagfwdlmlc.com (Malware_Distribution)"; content:"|0b|liagfwdlmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lj1i16b0.com ()"; content:"|08|lj1i16b0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkaturi71.com ()"; content:"|09|lkaturi71|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkaturl11.com ()"; content:"|09|lkaturl11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkaturl71.com ()"; content:"|09|lkaturl71|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lo4undreyk.com ()"; content:"|0a|lo4undreyk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lohetakiseduro.com (Spyware)"; content:"|0e|lohetakiseduro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lolaqodudag.com (Spyware)"; content:"|0b|lolaqodudag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lolypositole.com (Spyware)"; content:"|0c|lolypositole|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lopibobuheqixi.com (Spyware)"; content:"|0e|lopibobuheqixi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loqinolecowary.com (Spyware)"; content:"|0e|loqinolecowary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotenovezyzoba.com (Spyware)"; content:"|0e|lotenovezyzoba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lycibepof.com (Spyware)"; content:"|09|lycibepof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lygakefaju.com (Spyware)"; content:"|0a|lygakefaju|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magiclabstudio.com (Zeus_Zbot_SpyEye)"; content:"|0e|magiclabstudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mazyzykuboqo.com (Spyware)"; content:"|0c|mazyzykuboqo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcdpemlmoxk.com (Malware_Distribution)"; content:"|0b|mcdpemlmoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdegaccmoxk.com (Malware_Distribution)"; content:"|0b|mdegaccmoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meputabex.com (Spyware)"; content:"|09|meputabex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miacbyxmoxk.com (Malware_Distribution)"; content:"|0b|miacbyxmoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro.pic.semearweb.com (Malware_Distribution)"; content:"|05|micro|03|pic|09|semearweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoftserver.cx.cc (Malware_Infectors)"; content:"|0f|microsoftserver|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup midsouthrailroadservice.com (Botnet_C&C)"; content:"|17|midsouthrailroadservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n16fa53.com ()"; content:"|07|n16fa53|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neyversde5d7.dnsrd.com (Malware_Infectors)"; content:"|0c|neyversde5d7|05|dnsrd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neywrika.in ()"; content:"|08|neywrika|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nichtadden.in ()"; content:"|0a|nichtadden|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nl6fa53.com ()"; content:"|07|nl6fa53|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyewrika.in ()"; content:"|08|nyewrika|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obtas.com (Botnet_C&C)"; content:"|05|obtas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ocdftnbooxk.com (Malware_Distribution)"; content:"|0b|ocdftnbooxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineopps.co.cc ()"; content:"|0a|onlineopps|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parcozesz61.dns-dns.com (Malware_Distribution)"; content:"|0b|parcozesz61|07|dns-dns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portalbankline.com (Malware_Distribution)"; content:"|0e|portalbankline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup precestrasiphildl.dumb1.com (Malware_Infectors)"; content:"|11|precestrasiphildl|05|dumb1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profitgroup.co.cc ()"; content:"|0b|profitgroup|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pubbarataria.es (Malware_Distribution)"; content:"|0c|pubbarataria|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rukkeianno.com ()"; content:"|0a|rukkeianno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rukkeianno.in ()"; content:"|0a|rukkeianno|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rukkieanno.in ()"; content:"|0a|rukkieanno|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup russianelite-jabber.org (Zeus_Zbot_SpyEye)"; content:"|13|russianelite-jabber|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdegapcsoxk.com (Malware_Distribution)"; content:"|0b|sdegapcsoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searlas.ru (Malware_Infectors)"; content:"|07|searlas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitycenter.cx.cc (Malware_Infectors)"; content:"|0e|securitycenter|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitycentral.cx.cc (Malware_Infectors)"; content:"|0f|securitycentral|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityserver.cx.cc (Malware_Infectors)"; content:"|0e|securityserver|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysolution2011in.com (Spyware)"; content:"|16|securitysolution2011in|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setiawan.ru (Malware_Infectors)"; content:"|08|setiawan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sh01cilewk.com ()"; content:"|0a|sh01cilewk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sho1cilewk.com ()"; content:"|0a|sho1cilewk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup silanakron.com (Malware_Distribution)"; content:"|0a|silanakron|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simant.ru (Malware_Distribution)"; content:"|06|simant|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soha.us (Botnet_C&C)"; content:"|04|soha|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spor58.com (Botnet_C&C)"; content:"|06|spor58|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sskazzzz.com (Malware_Distribution)"; content:"|08|sskazzzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stocunintermussfp.4dq.com (Malware_Distribution)"; content:"|11|stocunintermussfp|03|4dq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweetlaketown.com (Malware_Distribution)"; content:"|0d|sweetlaketown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup test.whnconstruction.com (Malware_Distribution)"; content:"|04|test|0f|whnconstruction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thatgoneaway.com (Malware_Distribution)"; content:"|0c|thatgoneaway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tibaciwof.com (Spyware)"; content:"|09|tibaciwof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiomanernautie.ftp1.biz (Malware_Distribution)"; content:"|0e|tiomanernautie|04|ftp1|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackingups.org (Botnet_C&C)"; content:"|0b|trackingups|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u101mnay2k.com ()"; content:"|0a|u101mnay2k|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u101mnuy2k.com ()"; content:"|0a|u101mnuy2k|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uoujhgkwgfud.com (Malware_Distribution)"; content:"|0c|uoujhgkwgfud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvd.kr (Malware_Infectors)"; content:"|03|vvd|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webnewspapersp.tk (Malware_Infectors)"; content:"|0e|webnewspapersp|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wholesaleperfumebargains.com (Botnet_C&C)"; content:"|18|wholesaleperfumebargains|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wk1888.com (Malware_Distribution)"; content:"|06|wk1888|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xx87lhfda88.com ()"; content:"|0b|xx87lhfda88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yitzhakfolke.ru (Malware_Distribution)"; content:"|0c|yitzhakfolke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yuwteu2uj3fj.com (Malware_Infectors)"; content:"|0c|yuwteu2uj3fj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zna61udha01.com ()"; content:"|0b|zna61udha01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zna81udha01.com ()"; content:"|0b|zna81udha01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zz87ihfda88.com ()"; content:"|0b|zz87ihfda88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zz87lhfda88.com ()"; content:"|0b|zz87lhfda88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astped.com (Malware_Distribution)"; content:"|06|astped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todped.com (Malware_Distribution)"; content:"|06|todped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0o0o0o0o0.com ()"; content:"|09|0o0o0o0o0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-microsoft.com (Zeus_Zbot_SpyEye)"; content:"|0b|1-microsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 136136.com ()"; content:"|06|136136|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 19js810300z.com ()"; content:"|0b|19js810300z|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1iii1i11i1ii.com ()"; content:"|0c|1iii1i11i1ii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1zabslwvn538n4i5tcjl.com ()"; content:"|14|1zabslwvn538n4i5tcjl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3-d-0.com ()"; content:"|05|3-d-0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3hosting4u.ir (Zeus_Zbot_SpyEye)"; content:"|0a|3hosting4u|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4587avvv.1gb.ru (Zeus_Zbot_SpyEye)"; content:"|08|4587avvv|03|1gb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 45search.com ()"; content:"|08|45search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4ego.teleffonov.net (Phishing_and_Theft)"; content:"|04|4ego|0a|teleffonov|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5berty3uertb.com ()"; content:"|0c|5berty3uertb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 77quvo.com ()"; content:"|06|77quvo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 873hgf7xx60.com ()"; content:"|0b|873hgf7xx60|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaaadminmont.com (Malware_Infectors)"; content:"|0c|aaaadminmont|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aabalhtabvf.com (Malware_Infectors)"; content:"|0b|aabalhtabvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aabeejyafds.com (Malware_Infectors)"; content:"|0b|aabeejyafds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaboyriafds.com (Malware_Infectors)"; content:"|0b|aaboyriafds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aahydrogen.com (Malware_Infectors)"; content:"|0a|aahydrogen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abaronaweb.net ()"; content:"|0a|abaronaweb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aboutflipware.in (Botnet_C&C)"; content:"|0d|aboutflipware|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abtdiagnostic.com (Malware_Infectors)"; content:"|0d|abtdiagnostic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aburame.info (Zeus_Zbot_SpyEye)"; content:"|07|aburame|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdldagafds.com (Malware_Infectors)"; content:"|0b|acdldagafds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acidsource.com (Zeus_Zbot_SpyEye)"; content:"|0a|acidsource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acofinder.com (Malware_Infectors)"; content:"|09|acofinder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adgorge.com ()"; content:"|07|adgorge|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads.ew.com.cn ()"; content:"|03|ads|02|ew|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aebankonline.com (Malware_Infectors)"; content:"|0c|aebankonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aebrook.com ()"; content:"|07|aebrook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aefesixabvf.com (Malware_Infectors)"; content:"|0b|aefesixabvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afreepack.com (Botnet_C&C)"; content:"|09|afreepack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afretroactive.com (Malware_Infectors)"; content:"|0d|afretroactive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aftermaoart.com (Botnet_C&C)"; content:"|0b|aftermaoart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghkvkfafds.com (Malware_Infectors)"; content:"|0b|aghkvkfafds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aginder.net ()"; content:"|07|aginder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agizioonline.com (Botnet_C&C)"; content:"|0c|agizioonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aglardgr.com ()"; content:"|08|aglardgr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agrofee.com (Malware_Infectors)"; content:"|07|agrofee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahjqndlafds.com (Malware_Infectors)"; content:"|0b|ahjqndlafds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup airlinesfare.net (Botnet_C&C)"; content:"|0c|airlinesfare|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akmnds.net ()"; content:"|06|akmnds|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alimonyforces.com (Zeus_Zbot_SpyEye)"; content:"|0d|alimonyforces|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alimonyforcessd34.com (Zeus_Zbot_SpyEye)"; content:"|11|alimonyforcessd34|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allartsonline.com (Botnet_C&C)"; content:"|0d|allartsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allnetart.com (Botnet_C&C)"; content:"|09|allnetart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anadtyskland.com (Malware_Infectors)"; content:"|0c|anadtyskland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidxxs.com (Botnet_C&C)"; content:"|0a|androidxxs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspc-update.com (Fake_AV)"; content:"|12|antiviruspc-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apocalypt2.net (Zeus_Zbot_SpyEye)"; content:"|0a|apocalypt2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appppa1.ru (Zeus_Zbot_SpyEye)"; content:"|07|appppa1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armyerror.ru (Malware_Infectors)"; content:"|09|armyerror|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arta.romail3arnest.info (Zeus_Zbot_SpyEye)"; content:"|04|arta|0d|romail3arnest|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artcooldesign.com (Botnet_C&C)"; content:"|0d|artcooldesign|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artph.com (Botnet_C&C)"; content:"|05|artph|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artrockdisplay.com (Botnet_C&C)"; content:"|0e|artrockdisplay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artscarparts.com (Botnet_C&C)"; content:"|0c|artscarparts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artscraftsstudio.com (Botnet_C&C)"; content:"|10|artscraftsstudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artsgallerysite.com (Botnet_C&C)"; content:"|0f|artsgallerysite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asiaartsonline.com (Botnet_C&C)"; content:"|0e|asiaartsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ateapple.com.ua (Zeus_Zbot_SpyEye)"; content:"|08|ateapple|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atlas55.com (Zeus_Zbot_SpyEye)"; content:"|07|atlas55|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auctionhouseart.com (Botnet_C&C)"; content:"|0f|auctionhouseart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aukanah1.com (Phishing_and_Theft)"; content:"|08|aukanah1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aut0mat.info ()"; content:"|07|aut0mat|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autoandarts.com (Botnet_C&C)"; content:"|0b|autoandarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-support-2011.com (Spyware)"; content:"|0f|av-support-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-support2011.com (Spyware)"; content:"|0e|av-support2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avacerolive.net (Botnet_C&C)"; content:"|0b|avacerolive|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avspuberschewis.com (Malware_Infectors)"; content:"|0f|avspuberschewis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsupport-2011.com (Spyware)"; content:"|0e|avsupport-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsupport2011.com (Spyware)"; content:"|0d|avsupport2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awecerybtuitbyatr.com (Zeus_Zbot_SpyEye)"; content:"|11|awecerybtuitbyatr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azuzyrimazy.com (Spyware)"; content:"|0b|azuzyrimazy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babblespan.com (Botnet_C&C)"; content:"|0a|babblespan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baboeing.com ()"; content:"|08|baboeing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babyboompage.com ()"; content:"|0c|babyboompage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babypin.net (Zeus_Zbot_SpyEye)"; content:"|07|babypin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babyshompage.com ()"; content:"|0c|babyshompage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup backorderru.com (Zeus_Zbot_SpyEye)"; content:"|0b|backorderru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banekaxuxu.com (Spyware)"; content:"|0a|banekaxuxu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barcalys-trial.com (Zeus_Zbot_SpyEye)"; content:"|0e|barcalys-trial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barcalys-trial2.com (Zeus_Zbot_SpyEye)"; content:"|0f|barcalys-trial2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bargainfloralarts.com (Botnet_C&C)"; content:"|11|bargainfloralarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basinobof.com (Spyware)"; content:"|09|basinobof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bastocks.com (Malware_Infectors)"; content:"|08|bastocks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baxyzasagisoq.com (Spyware)"; content:"|0d|baxyzasagisoq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bebecebyt.com (Spyware)"; content:"|09|bebecebyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bemojewedowigo.com (Spyware)"; content:"|0e|bemojewedowigo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bezyxafib.com (Spyware)"; content:"|09|bezyxafib|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bibefucurohadu.com (Spyware)"; content:"|0e|bibefucurohadu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bipojizikagec.com (Spyware)"; content:"|0d|bipojizikagec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup black-hosting.ru (Zeus_Zbot_SpyEye)"; content:"|0d|black-hosting|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bodylarozityd.com (Spyware)"; content:"|0d|bodylarozityd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bojimipim.com (Spyware)"; content:"|09|bojimipim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bringithomedude.com (Zeus_Zbot_SpyEye)"; content:"|0f|bringithomedude|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bx1.biz (Zeus_Zbot_SpyEye)"; content:"|03|bx1|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bxpartner.com (Zeus_Zbot_SpyEye)"; content:"|09|bxpartner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centizzy.net ()"; content:"|08|centizzy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cerpoo.com (Malware_Distribution)"; content:"|06|cerpoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connectionsupport.org (Zeus_Zbot_SpyEye)"; content:"|11|connectionsupport|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crowledblade.com ()"; content:"|0c|crowledblade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dosdm.com (Phishing_and_Theft)"; content:"|05|dosdm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynambu.net ()"; content:"|07|dynambu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ess-tool.com (Spyware)"; content:"|08|ess-tool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euarabsmeconf.com (Zeus_Zbot_SpyEye)"; content:"|0d|euarabsmeconf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exxcalibur.tv (Zeus_Zbot_SpyEye)"; content:"|0a|exxcalibur|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galichina.zaporizhzhe.ua (Zeus_Zbot_SpyEye)"; content:"|09|galichina|0b|zaporizhzhe|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gangbang.angels-agency.nl (Botnet_C&C)"; content:"|08|gangbang|0d|angels-agency|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodmediadata.in (Malware_Infectors)"; content:"|0d|goodmediadata|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackhound.org.uk (Zeus_Zbot_SpyEye)"; content:"|09|hackhound|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imacdefence.com (Spyware)"; content:"|0b|imacdefence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jrkxkf.com ()"; content:"|06|jrkxkf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koburana.ru (Zeus_Zbot_SpyEye)"; content:"|08|koburana|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m10000.net (Zeus_Zbot_SpyEye)"; content:"|06|m10000|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mabckgymmlc.com (Malware_Distribution)"; content:"|0b|mabckgymmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mac-protection.com (Spyware)"; content:"|0e|mac-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mapper-guide.org (Zeus_Zbot_SpyEye)"; content:"|0c|mapper-guide|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mauuro.com (Phishing_and_Theft)"; content:"|06|mauuro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcdtusqmmlc.com (Malware_Distribution)"; content:"|0b|mcdtusqmmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcduipqmoxk.com (Malware_Distribution)"; content:"|0b|mcduipqmoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mefgfjdmmlc.com (Malware_Distribution)"; content:"|0b|mefgfjdmmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mefwvesmoxk.com (Malware_Distribution)"; content:"|0b|mefwvesmoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup melankolik.us (Phishing_and_Theft)"; content:"|0a|melankolik|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup melio823mn.com ()"; content:"|0a|melio823mn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metin2blog.com (Phishing_and_Theft)"; content:"|0a|metin2blog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mghnpmkmmlc.com (Malware_Distribution)"; content:"|0b|mghnpmkmmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mghspzpmmlc.com (Malware_Distribution)"; content:"|0b|mghspzpmmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mhjouclmmlc.com (Malware_Distribution)"; content:"|0b|mhjouclmmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-spynet.com (Zeus_Zbot_SpyEye)"; content:"|10|microsoft-spynet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mindfuckweed.ru (Zeus_Zbot_SpyEye)"; content:"|0c|mindfuckweed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minerva.cdmon.org (Botnet_C&C)"; content:"|07|minerva|05|cdmon|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mjipajmmmlc.com (Malware_Distribution)"; content:"|0b|mjipajmmmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicparadice.com ()"; content:"|0d|musicparadice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odeaakwomlc.com (Malware_Distribution)"; content:"|0b|odeaakwomlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ofgwkvtomlc.com (Malware_Distribution)"; content:"|0b|ofgwkvtomlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oiarqznooxk.com (Malware_Distribution)"; content:"|0b|oiarqznooxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup padknvc.com (Malware_Distribution)"; content:"|07|padknvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdefaqcpmlc.com (Malware_Distribution)"; content:"|0b|pdefaqcpmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ping-nowdata.tk (Spyware)"; content:"|0c|ping-nowdata|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ping-nowmap.tk (Spyware)"; content:"|0b|ping-nowmap|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ping-nowpeaple.tk (Spyware)"; content:"|0e|ping-nowpeaple|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ping-nowworld.tk (Spyware)"; content:"|0d|ping-nowworld|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poltern.in (Malware_Infectors)"; content:"|07|poltern|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornourl.tv (Zeus_Zbot_SpyEye)"; content:"|08|pornourl|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppobhkmn598d4k83.com (Zeus_Zbot_SpyEye)"; content:"|10|ppobhkmn598d4k83|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privathosting.be (Zeus_Zbot_SpyEye)"; content:"|0d|privathosting|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privathosting.eu (Zeus_Zbot_SpyEye)"; content:"|0d|privathosting|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qabmkeiqmlc.com (Malware_Distribution)"; content:"|0b|qabmkeiqmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qrtfgvjsy2u.com (Malware_Distribution)"; content:"|0b|qrtfgvjsy2u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qty25yhfava.com (Malware_Distribution)"; content:"|0b|qty25yhfava|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riffwire.net ()"; content:"|08|riffwire|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sabwkntsmlc.com (Malware_Distribution)"; content:"|0b|sabwkntsmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanermn-strong.tk (Spyware)"; content:"|0f|scanermn-strong|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdf4gdf3fdjhk.com (Malware_Distribution)"; content:"|0d|sdf4gdf3fdjhk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdjg3t872yih.com (Malware_Distribution)"; content:"|0c|sdjg3t872yih|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servers02.org (Zeus_Zbot_SpyEye)"; content:"|09|servers02|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sghoxiksoxk.com (Malware_Distribution)"; content:"|0b|sghoxiksoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup share-finder.com ()"; content:"|0c|share-finder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siarqonsoxk.com (Malware_Distribution)"; content:"|0b|siarqonsoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skkhe3iyh.com (Malware_Distribution)"; content:"|09|skkhe3iyh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slj3khjtsd.com (Malware_Distribution)"; content:"|0a|slj3khjtsd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somy-sony.com ()"; content:"|09|somy-sony|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spinchats.com (Zeus_Zbot_SpyEye)"; content:"|09|spinchats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spys.fvds.ru (Zeus_Zbot_SpyEye)"; content:"|04|spys|04|fvds|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup th2gffeyrs.com (Malware_Distribution)"; content:"|0a|th2gffeyrs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalscanz-dll.tk (Spyware)"; content:"|0e|totalscanz-dll|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalscanz-if.tk (Spyware)"; content:"|0d|totalscanz-if|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalscanz-note.tk (Spyware)"; content:"|0f|totalscanz-note|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyhgljsfaksa.com (Malware_Distribution)"; content:"|0c|tyhgljsfaksa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubcxpbuumlc.com (Malware_Distribution)"; content:"|0b|ubcxpbuumlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ughjpgfumlc.com (Malware_Distribution)"; content:"|0b|ughjpgfumlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uiwjbddva2.com (Malware_Distribution)"; content:"|0a|uiwjbddva2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uiwy3gv42j4cfu4.com (Malware_Distribution)"; content:"|0f|uiwy3gv42j4cfu4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updsys.net (Zeus_Zbot_SpyEye)"; content:"|06|updsys|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voidrage.com (Zeus_Zbot_SpyEye)"; content:"|08|voidrage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w638igfhks.com (Malware_Distribution)"; content:"|0a|w638igfhks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wikiva.net ()"; content:"|06|wikiva|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worlddatahouse.com (Zeus_Zbot_SpyEye)"; content:"|0e|worlddatahouse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wt376tugwc.com (Malware_Distribution)"; content:"|0a|wt376tugwc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhfs3rtgj.com (Malware_Distribution)"; content:"|09|yhfs3rtgj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yu3uygfvsc.com (Malware_Distribution)"; content:"|0a|yu3uygfvsc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yuwtuqfv2b.com (Malware_Distribution)"; content:"|0a|yuwtuqfv2b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ywutqwqe.com (Malware_Distribution)"; content:"|08|ywutqwqe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addomains.ru (Malware_Distribution)"; content:"|09|addomains|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1r0d.info (Malware_Infectors)"; content:"|04|1r0d|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1r1s.info (Malware_Infectors)"; content:"|04|1r1s|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2x5.us (Zeus_Zbot_SpyEye)"; content:"|03|2x5|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad1n.info (Malware_Infectors)"; content:"|04|ad1n|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adnet.tunserver.info (Zeus_Zbot_SpyEye)"; content:"|05|adnet|09|tunserver|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adrd.xiaxiab.com (Botnet_C&C)"; content:"|04|adrd|07|xiaxiab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armedical.info ()"; content:"|09|armedical|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armmedical.info ()"; content:"|0a|armmedical|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup art-groupintegreted.com (Phishing_and_Theft)"; content:"|13|art-groupintegreted|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artintegrated-group.net (Phishing_and_Theft)"; content:"|13|artintegrated-group|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auicnhqtvnmdnn.info (Zeus_Zbot_SpyEye)"; content:"|0e|auicnhqtvnmdnn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axb.pl (Malware_Distribution)"; content:"|03|axb|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belaruskabel.ru (Malware_Distribution)"; content:"|0c|belaruskabel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellicoreturbo.ru (Zeus_Zbot_SpyEye)"; content:"|0e|bellicoreturbo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-clansite.de (Malware_Distribution)"; content:"|0d|best-clansite|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmediagreat.org (Malware_Infectors)"; content:"|0e|bestmediagreat|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bossale.com ()"; content:"|07|bossale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celshadeartists.com (Malware_Distribution)"; content:"|0f|celshadeartists|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickarvada.org (Spyware)"; content:"|0b|clickarvada|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickolathe.org (Spyware)"; content:"|0b|clickolathe|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contemp-usainc.com (Phishing_and_Theft)"; content:"|0e|contemp-usainc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contemp-usgroup.com (Phishing_and_Theft)"; content:"|0f|contemp-usgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup converter50.com (Zeus_Zbot_SpyEye)"; content:"|0b|converter50|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d0za.info (Malware_Infectors)"; content:"|04|d0za|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emergencysoft.com ()"; content:"|0d|emergencysoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewe2.info (Malware_Infectors)"; content:"|04|ewe2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanaras.gr (Botnet_C&C)"; content:"|07|fanaras|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feldmar.ru (Zeus_Zbot_SpyEye)"; content:"|07|feldmar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fhfhfe880.com (Zeus_Zbot_SpyEye)"; content:"|09|fhfhfe880|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiaesmxfb4f.com (Malware_Infectors)"; content:"|0b|fiaesmxfb4f|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fifa2012tgame.com (Zeus_Zbot_SpyEye)"; content:"|0d|fifa2012tgame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesarchivesite.in (Botnet_C&C)"; content:"|10|filesarchivesite|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmoviebox.in (Botnet_C&C)"; content:"|0b|filmoviebox|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findeffectivecasino.com ()"; content:"|13|findeffectivecasino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findtoup.com (Zeus_Zbot_SpyEye)"; content:"|08|findtoup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeonlinedatingtips.net (Malware_Infectors)"; content:"|14|freeonlinedatingtips|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fxweixin.com (Malware_Distribution)"; content:"|08|fxweixin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geme555.com ()"; content:"|07|geme555|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geme98.com ()"; content:"|06|geme98|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlemaps5.com (Zeus_Zbot_SpyEye)"; content:"|0b|googlemaps5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gozukopomiva.com (Spyware)"; content:"|0c|gozukopomiva|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guvupajixum.com (Spyware)"; content:"|0b|guvupajixum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwjlvmji.org.in (Malware_Distribution)"; content:"|08|gwjlvmji|03|org|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gydisolejuj.com (Spyware)"; content:"|0b|gydisolejuj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gygokelara.com (Spyware)"; content:"|0a|gygokelara|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hadolalat.com (Spyware)"; content:"|09|hadolalat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hegylocimemyja.com (Spyware)"; content:"|0e|hegylocimemyja|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hehabocawezawe.com (Spyware)"; content:"|0e|hehabocawezawe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hikiniribep.com (Spyware)"; content:"|0b|hikiniribep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup historykiller.net ()"; content:"|0d|historykiller|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup historykillerpro.biz ()"; content:"|10|historykillerpro|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup historykillerpro.com ()"; content:"|10|historykillerpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup historykillerpro.info ()"; content:"|10|historykillerpro|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup historykillerpro.net ()"; content:"|10|historykillerpro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup historykillerpro.org ()"; content:"|10|historykillerpro|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hohimedag.com (Spyware)"; content:"|09|hohimedag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotmailbox.com (Botnet_C&C)"; content:"|0a|hotmailbox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hrvvvcwlzioqjpxy.com (Zeus_Zbot_SpyEye)"; content:"|10|hrvvvcwlzioqjpxy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instantmediaplay.biz (Malware_Infectors)"; content:"|10|instantmediaplay|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup integrated-europe-it.net (Phishing_and_Theft)"; content:"|14|integrated-europe-it|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iovthfqqguyovj.info (Zeus_Zbot_SpyEye)"; content:"|0e|iovthfqqguyovj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup it-analisys.com (Phishing_and_Theft)"; content:"|0b|it-analisys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itagroup-usa.net (Phishing_and_Theft)"; content:"|0c|itagroup-usa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itanalysisgroup.net (Phishing_and_Theft)"; content:"|0f|itanalysisgroup|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjwkxhzwpoksgf.info (Zeus_Zbot_SpyEye)"; content:"|0e|jjwkxhzwpoksgf|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jldnjxmpmrqymlm.org (Zeus_Zbot_SpyEye)"; content:"|0f|jldnjxmpmrqymlm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-britain.com (Fake_AV)"; content:"|0b|job-britain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job4america.com (Fake_AV)"; content:"|0b|job4america|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ka3ek.com ()"; content:"|05|ka3ek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjmkwnkknxuqpipl.com (Zeus_Zbot_SpyEye)"; content:"|10|kjmkwnkknxuqpipl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kqgvjvltqketimk.net (Zeus_Zbot_SpyEye)"; content:"|0f|kqgvjvltqketimk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kr0m.info (Malware_Infectors)"; content:"|04|kr0m|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lashou.com (Malware_Distribution)"; content:"|06|lashou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup level-upgrade.com (Zeus_Zbot_SpyEye)"; content:"|0d|level-upgrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lipvirhwxpglieuo.com (Zeus_Zbot_SpyEye)"; content:"|10|lipvirhwxpglieuo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup listenonlineradio.org ()"; content:"|11|listenonlineradio|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lspijguwwtmjhil.info (Zeus_Zbot_SpyEye)"; content:"|0f|lspijguwwtmjhil|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masterartusa.com (Phishing_and_Theft)"; content:"|0c|masterartusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mxoqiytswkopppk.com (Zeus_Zbot_SpyEye)"; content:"|0f|mxoqiytswkopppk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odggxspmmrdqhjxu.net (Zeus_Zbot_SpyEye)"; content:"|10|odggxspmmrdqhjxu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oerotrading.com (Malware_Distribution)"; content:"|0b|oerotrading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okbiunqporkisqm.biz (Zeus_Zbot_SpyEye)"; content:"|0f|okbiunqporkisqm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfurtorkerhortar.com (Zeus_Zbot_SpyEye)"; content:"|12|perfurtorkerhortar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjionrlhphloyunp.net (Zeus_Zbot_SpyEye)"; content:"|10|pjionrlhphloyunp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjpsohzpvvqfcquw.net (Zeus_Zbot_SpyEye)"; content:"|10|pjpsohzpvvqfcquw|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppppnipponp.r7m.us (Zeus_Zbot_SpyEye)"; content:"|0b|ppppnipponp|03|r7m|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppwmklrxogzrvjxt.org (Zeus_Zbot_SpyEye)"; content:"|10|ppwmklrxogzrvjxt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profilinstylin.com (Malware_Infectors)"; content:"|0e|profilinstylin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptunfpolollerwp.org (Zeus_Zbot_SpyEye)"; content:"|0f|ptunfpolollerwp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puvqrdwrxvdbkiv.com (Zeus_Zbot_SpyEye)"; content:"|0f|puvqrdwrxvdbkiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pwpzguwhvrvdtrlq.com (Zeus_Zbot_SpyEye)"; content:"|10|pwpzguwhvrvdtrlq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pxmkkgvt.org.in (Malware_Distribution)"; content:"|08|pxmkkgvt|03|org|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlntsqpzvofrsipt.com (Zeus_Zbot_SpyEye)"; content:"|10|qlntsqpzvofrsipt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qswqqwpdtxsmnqqu.com (Zeus_Zbot_SpyEye)"; content:"|10|qswqqwpdtxsmnqqu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qsxpprdrqjsqtlil.org (Zeus_Zbot_SpyEye)"; content:"|10|qsxpprdrqjsqtlil|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riggleman.in (Botnet_C&C)"; content:"|09|riggleman|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rqvofrpcnljmxk.com (Zeus_Zbot_SpyEye)"; content:"|0e|rqvofrpcnljmxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rryfquvsdnwtvym.info (Zeus_Zbot_SpyEye)"; content:"|0f|rryfquvsdnwtvym|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrzkvxeorzotrixk.net (Zeus_Zbot_SpyEye)"; content:"|10|rrzkvxeorzotrixk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rshpoiastmsjpwsw.com (Zeus_Zbot_SpyEye)"; content:"|10|rshpoiastmsjpwsw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s34.uni.cc (Malware_Infectors)"; content:"|03|s34|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s35.uni.cc (Malware_Infectors)"; content:"|03|s35|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safetysamvps.info (Botnet_C&C)"; content:"|0c|safetysamvps|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scar-beiinc.com (Phishing_and_Theft)"; content:"|0b|scar-beiinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sibertreet.cx.cc ()"; content:"|0a|sibertreet|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slade.safehousenumber.com ()"; content:"|05|slade|0f|safehousenumber|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-llc-uk.net (Phishing_and_Theft)"; content:"|0c|smart-llc-uk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartllc-uk.com (Phishing_and_Theft)"; content:"|0b|smartllc-uk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soundlinks.in (Botnet_C&C)"; content:"|0a|soundlinks|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soypolilla.com ()"; content:"|0a|soypolilla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sqpotwnuoxsqrsnu.com (Zeus_Zbot_SpyEye)"; content:"|10|sqpotwnuoxsqrsnu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sublimeltd.com (Phishing_and_Theft)"; content:"|0a|sublimeltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermediafly.net (Malware_Infectors)"; content:"|0d|supermediafly|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swktolmmjipgthoq.com (Zeus_Zbot_SpyEye)"; content:"|10|swktolmmjipgthoq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sxniosjfvoswmnsu.org (Zeus_Zbot_SpyEye)"; content:"|10|sxniosjfvoswmnsu|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themultimediaplant.info (Malware_Infectors)"; content:"|12|themultimediaplant|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiigltrkrkwrtmpr.com (Zeus_Zbot_SpyEye)"; content:"|10|tiigltrkrkwrtmpr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tlfinuonyyrvnh.biz (Zeus_Zbot_SpyEye)"; content:"|0e|tlfinuonyyrvnh|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tmoqrlmdlnopze.com (Zeus_Zbot_SpyEye)"; content:"|0e|tmoqrlmdlnopze|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafflist.com (Malware_Distribution)"; content:"|09|trafflist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffurl.ru (Malware_Distribution)"; content:"|08|traffurl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2616896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trakyareklam.net (Malware_Distribution)"; content:"|0c|trakyareklam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trivuonline.in (Botnet_C&C)"; content:"|0b|trivuonline|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujotruorqxpmoob.com (Zeus_Zbot_SpyEye)"; content:"|0f|ujotruorqxpmoob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urlrhrlxfsxdurtq.org (Zeus_Zbot_SpyEye)"; content:"|10|urlrhrlxfsxdurtq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vmjtfjhorfvltr.org (Zeus_Zbot_SpyEye)"; content:"|0e|vmjtfjhorfvltr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vol777.com (Malware_Distribution)"; content:"|06|vol777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvgauction.tld.tc (Malware_Distribution)"; content:"|0a|vvgauction|03|tld|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vxqtmjkgkztxpm.biz (Zeus_Zbot_SpyEye)"; content:"|0e|vxqtmjkgkztxpm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vzglrbnvookvolgr.info (Zeus_Zbot_SpyEye)"; content:"|10|vzglrbnvookvolgr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westgroupcv.net (Fake_AV)"; content:"|0b|westgroupcv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpfoknioiufskhij.info (Zeus_Zbot_SpyEye)"; content:"|10|wpfoknioiufskhij|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wqhnokxistmjjkjw.com (Zeus_Zbot_SpyEye)"; content:"|10|wqhnokxistmjjkjw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wug-cunsulting.net (Fake_AV)"; content:"|0e|wug-cunsulting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wug-joblist.com (Fake_AV)"; content:"|0b|wug-joblist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wugcv-offers.com (Fake_AV)"; content:"|0c|wugcv-offers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytjmrnnuloeqojpr.org (Zeus_Zbot_SpyEye)"; content:"|10|ytjmrnnuloeqojpr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jikped.com (Malware_Distribution)"; content:"|06|jikped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abra-kadabra-botnet.co.cc (Zeus_Zbot_SpyEye)"; content:"|13|abra-kadabra-botnet|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advcnnce.cn (Malware_Infectors)"; content:"|08|advcnnce|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup airstyleimports.com.au (Zeus_Zbot_SpyEye)"; content:"|0f|airstyleimports|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazingcrazyhothaha.com (Spyware)"; content:"|13|amazingcrazyhothaha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazinggreatprofilevideo.com (Spyware)"; content:"|18|amazinggreatprofilevideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazinginsanehahavideos.com (Spyware)"; content:"|17|amazinginsanehahavideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazinginsaneimageswow.com (Spyware)"; content:"|16|amazinginsaneimageswow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazinglolpics.com (Spyware)"; content:"|0e|amazinglolpics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazingprofilevideos.com (Spyware)"; content:"|14|amazingprofilevideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazingvideoinsanevideos.com (Spyware)"; content:"|18|amazingvideoinsanevideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazingvideounrealimages.com (Spyware)"; content:"|18|amazingvideounrealimages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazingvideovideoshilarious.com (Spyware)"; content:"|1b|amazingvideovideoshilarious|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazingwildhahasilly.com (Spyware)"; content:"|14|amazingwildhahasilly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americanmobile.ca (Malware_Infectors)"; content:"|0e|americanmobile|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anijrsfi.cn (Malware_Infectors)"; content:"|08|anijrsfi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archiveonlinemedia.com (Malware_Infectors)"; content:"|12|archiveonlinemedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfreeantivirus2012.com (Fake_AV)"; content:"|15|bestfreeantivirus2012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bgdjsqsn.cn (Malware_Infectors)"; content:"|08|bgdjsqsn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebs-movies-23.co.cc (Fake_AV)"; content:"|10|celebs-movies-23|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centerall4media.net (Malware_Infectors)"; content:"|0f|centerall4media|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crazyhilariousvideoamazing.com (Spyware)"; content:"|1a|crazyhilariousvideoamazing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxwtiges.cn (Malware_Infectors)"; content:"|08|cxwtiges|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyjcfwci.cn (Malware_Infectors)"; content:"|08|cyjcfwci|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datylegu.bridgerelmer.ru (Malware_Infectors)"; content:"|08|datylegu|0c|bridgerelmer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbeyosaygt.co.tv (Malware_Infectors)"; content:"|0a|dbeyosaygt|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnnyofza.cn (Malware_Infectors)"; content:"|08|dnnyofza|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eajxiv.cn (Malware_Infectors)"; content:"|06|eajxiv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erahacty.cn (Malware_Infectors)"; content:"|08|erahacty|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facenastynuttycrazy.com (Spyware)"; content:"|13|facenastynuttycrazy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup failwowvidnuts.com (Spyware)"; content:"|0e|failwowvidnuts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frexxx.gv.vg (Malware_Infectors)"; content:"|06|frexxx|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frvhydef.cn (Malware_Infectors)"; content:"|08|frvhydef|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funnyvideosvideo.com (Spyware)"; content:"|10|funnyvideosvideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getthesoft.co.cc (Fake_AV)"; content:"|0a|getthesoft|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gggggg.gv.vg (Malware_Infectors)"; content:"|06|gggggg|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghjvxdqgfds.com (Malware_Infectors)"; content:"|0b|ghjvxdqgfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gizrgnev.co.tv (Spyware)"; content:"|08|gizrgnev|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatcrazyhahawild.com (Spyware)"; content:"|12|greatcrazyhahawild|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatcrazywowwild.com (Spyware)"; content:"|11|greatcrazywowwild|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greathotinsanehaha.com (Spyware)"; content:"|12|greathotinsanehaha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatwildinsanehaha.com (Spyware)"; content:"|13|greatwildinsanehaha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatwildlolhaha.com (Spyware)"; content:"|10|greatwildlolhaha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gvddhcid.cn (Malware_Infectors)"; content:"|08|gvddhcid|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahaamazinghotcrazy.com (Spyware)"; content:"|13|hahaamazinghotcrazy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahainsaneamazingvideos.com (Spyware)"; content:"|17|hahainsaneamazingvideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahainsanehotnutty.com (Spyware)"; content:"|12|hahainsanehotnutty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahalolgreathot.com (Spyware)"; content:"|0f|hahalolgreathot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahalolgreatnasty.com (Spyware)"; content:"|11|hahalolgreatnasty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahalolhottag.com (Spyware)"; content:"|0d|hahalolhottag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahalolnuttyhot.com (Spyware)"; content:"|0f|hahalolnuttyhot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahalolvideosgreat.com (Spyware)"; content:"|12|hahalolvideosgreat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hanxdzlp.cn (Malware_Infectors)"; content:"|08|hanxdzlp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hutitero.bridgerelmer.ru (Malware_Infectors)"; content:"|08|hutitero|0c|bridgerelmer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iivxhdcd.cn (Malware_Infectors)"; content:"|08|iivxhdcd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagesamazingprofile.com (Spyware)"; content:"|14|imagesamazingprofile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irrationallyzciy.info (Spyware)"; content:"|10|irrationallyzciy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iyncifls.cn (Malware_Infectors)"; content:"|08|iyncifls|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jajhlvkw.cn (Malware_Infectors)"; content:"|08|jajhlvkw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jusyquqitonuv.com (Spyware)"; content:"|0d|jusyquqitonuv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jwwktxbk.cn (Malware_Infectors)"; content:"|08|jwwktxbk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kappfrance1.pck.nerim.net (Phishing_and_Theft)"; content:"|0b|kappfrance1|03|pck|05|nerim|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kijyjajutava.com (Spyware)"; content:"|0c|kijyjajutava|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kivewomahes.com (Spyware)"; content:"|0b|kivewomahes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiziwaqej.com (Spyware)"; content:"|09|kiziwaqej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kojapojaxymiqe.com (Spyware)"; content:"|0e|kojapojaxymiqe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kopynawemyvuda.com (Spyware)"; content:"|0e|kopynawemyvuda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kovejyvymuzi.com (Spyware)"; content:"|0c|kovejyvymuzi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kpdkycsf.cn (Malware_Infectors)"; content:"|08|kpdkycsf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lewokyvokizax.com (Spyware)"; content:"|0d|lewokyvokizax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ligusywib.com (Spyware)"; content:"|09|ligusywib|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liwajohiboby.com (Spyware)"; content:"|0c|liwajohiboby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ljiditu.cn (Malware_Infectors)"; content:"|07|ljiditu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lofocigeced.com (Spyware)"; content:"|0b|lofocigeced|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lofolajuk.com (Spyware)"; content:"|09|lofolajuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logamohew.com (Spyware)"; content:"|09|logamohew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaall4group.biz (Malware_Infectors)"; content:"|0e|mediaall4group|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megamediaarchive.com (Malware_Infectors)"; content:"|10|megamediaarchive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milotynabojavo.com (Spyware)"; content:"|0e|milotynabojavo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mipituhamys.com (Spyware)"; content:"|0b|mipituhamys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup misyneqewetypo.com (Spyware)"; content:"|0e|misyneqewetypo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mixolyzegito.com (Spyware)"; content:"|0c|mixolyzegito|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moayuetc.cn (Malware_Infectors)"; content:"|08|moayuetc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobosijeb.com (Spyware)"; content:"|09|mobosijeb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanhtzzk.cn (Malware_Infectors)"; content:"|08|nanhtzzk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newhappys.com (Malware_Infectors)"; content:"|09|newhappys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuttynastyfacecrazy.com (Spyware)"; content:"|13|nuttynastyfacecrazy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuttyvideossillyhaha.com (Spyware)"; content:"|14|nuttyvideossillyhaha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuxixepalefete.com (Spyware)"; content:"|0e|nuxixepalefete|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ojntarqg.cn (Malware_Infectors)"; content:"|08|ojntarqg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opgupta.org (Malware_Distribution)"; content:"|07|opgupta|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pempoo.com (Malware_Distribution)"; content:"|06|pempoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnwjogba.cn (Malware_Infectors)"; content:"|08|pnwjogba|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popularloadmedia.com (Malware_Infectors)"; content:"|10|popularloadmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portal-newdevice.tk (Spyware)"; content:"|10|portal-newdevice|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qhjgskbqfds.com (Malware_Infectors)"; content:"|0b|qhjgskbqfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjwddxep.cn (Malware_Infectors)"; content:"|08|qjwddxep|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rdehaccrfds.com (Malware_Infectors)"; content:"|0b|rdehaccrfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rwikltfw.cn (Malware_Infectors)"; content:"|08|rwikltfw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salmeort56.co.be (Malware_Infectors)"; content:"|0a|salmeort56|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spnkaamy.cn (Malware_Infectors)"; content:"|08|spnkaamy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagcrazyvideoswow.com (Spyware)"; content:"|11|tagcrazyvideoswow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taghothahalol.com (Spyware)"; content:"|0d|taghothahalol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagimagenutsgreat.com (Spyware)"; content:"|11|tagimagenutsgreat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagvideoshahalol.com (Spyware)"; content:"|10|tagvideoshahalol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagwowpostbook.com (Spyware)"; content:"|0e|tagwowpostbook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testapplicationmedia.com (Malware_Infectors)"; content:"|14|testapplicationmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testsoftwaremedia.net (Malware_Infectors)"; content:"|11|testsoftwaremedia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tgnjurmc.cn (Malware_Infectors)"; content:"|08|tgnjurmc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebloggin.net (Spyware)"; content:"|0a|thebloggin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup translateofmy.com (Zeus_Zbot_SpyEye)"; content:"|0d|translateofmy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubamarket.com (Malware_Distribution)"; content:"|0a|tubamarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ustertupak.com (Zeus_Zbot_SpyEye)"; content:"|0a|ustertupak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uxitfsui.cn (Malware_Infectors)"; content:"|08|uxitfsui|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdacaehg.cn (Malware_Infectors)"; content:"|08|vdacaehg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vpnqucz.co.tv (Spyware)"; content:"|07|vpnqucz|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-freepcsoft.com (Spyware)"; content:"|0e|web-freepcsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiaxzchu.cn (Malware_Infectors)"; content:"|08|wiaxzchu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wowtaglolhot.com (Spyware)"; content:"|0c|wowtaglolhot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xjdtnqie.cn (Malware_Infectors)"; content:"|08|xjdtnqie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xsslsrv.com (Zeus_Zbot_SpyEye)"; content:"|07|xsslsrv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yvndzaqu.cn (Malware_Infectors)"; content:"|08|yvndzaqu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zohyfybe.bridgerelmer.ru (Spyware)"; content:"|08|zohyfybe|0c|bridgerelmer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zovysnen.cn (Malware_Infectors)"; content:"|08|zovysnen|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 06emu.tk (Malware_Distribution)"; content:"|05|06emu|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 23asol.cu.cc (Malware_Infectors)"; content:"|06|23asol|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 38zu.cn (Malware_Distribution)"; content:"|04|38zu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6q97d.tk (Malware_Distribution)"; content:"|05|6q97d|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6ybh-upload.com (Malware_Infectors)"; content:"|0b|6ybh-upload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9qdq4.tk (Malware_Distribution)"; content:"|05|9qdq4|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agisis.com (Malware_Distribution)"; content:"|06|agisis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup albaimtra.com (Malware_Infectors)"; content:"|09|albaimtra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annstarqq.co.de (Malware_Distribution)"; content:"|09|annstarqq|02|co|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auto2011extwarranty.com (Malware_Distribution)"; content:"|13|auto2011extwarranty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup automaticscredit.com (Malware_Distribution)"; content:"|10|automaticscredit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beritaterbaru.tk (Malware_Distribution)"; content:"|0d|beritaterbaru|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogerim.co.il (Malware_Infectors)"; content:"|08|blogerim|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bomarketingsolutions.com (Malware_Distribution)"; content:"|14|bomarketingsolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buderibojine.com (Spyware)"; content:"|0c|buderibojine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byzexysomahyvi.com (Spyware)"; content:"|0e|byzexysomahyvi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccsncprkid.com (Malware_Infectors)"; content:"|0a|ccsncprkid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdmirandes.com (Malware_Infectors)"; content:"|0a|cdmirandes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centralscoreupdates.info (Malware_Distribution)"; content:"|13|centralscoreupdates|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computerhackingforensicinvestigator.com (Malware_Distribution)"; content:"|23|computerhackingforensicinvestigator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup consumer2011traxx.com (Malware_Distribution)"; content:"|11|consumer2011traxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creditingautos.com (Malware_Distribution)"; content:"|0e|creditingautos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cristhiannemodas.com.br (Malware_Infectors)"; content:"|10|cristhiannemodas|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup csdinformatica.net (Malware_Infectors)"; content:"|0e|csdinformatica|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup customercontactonline.bz (Malware_Distribution)"; content:"|15|customercontactonline|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cw.cm (Malware_Distribution)"; content:"|02|cw|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-gamer.3dn.ru (Malware_Distribution)"; content:"|0b|cyber-gamer|03|3dn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup depositodati.altervista.org (Malware_Infectors)"; content:"|0c|depositodati|0a|altervista|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dkz9.bz.cm (Malware_Distribution)"; content:"|04|dkz9|02|bz|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doitnow3.tk (Malware_Distribution)"; content:"|08|doitnow3|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doitnow4.tk (Malware_Distribution)"; content:"|08|doitnow4|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doitnow5.tk (Malware_Distribution)"; content:"|08|doitnow5|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ds9cx.tk (Malware_Distribution)"; content:"|05|ds9cx|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eltima.com (Malware_Distribution)"; content:"|06|eltima|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup experian365sources.com (Malware_Distribution)"; content:"|12|experian365sources|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expressequifaxes.info (Malware_Distribution)"; content:"|10|expressequifaxes|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fallasegonmil-leni.com (Malware_Infectors)"; content:"|12|fallasegonmil-leni|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdhbjgkfqfjggjk.cx.cc (Malware_Infectors)"; content:"|0f|fdhbjgkfqfjggjk|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findyourperfect6.tk (Malware_Distribution)"; content:"|10|findyourperfect6|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fxs-support.net (Malware_Distribution)"; content:"|0b|fxs-support|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gandon.cx.cc (Malware_Infectors)"; content:"|06|gandon|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-anallissticc.cx.cc (Malware_Distribution)"; content:"|13|google-anallissticc|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup habbpix.fr.gp (Malware_Distribution)"; content:"|07|habbpix|02|fr|02|gp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hentai3dgames.com (Malware_Infectors)"; content:"|0d|hentai3dgames|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hummforexxx.tk (Malware_Distribution)"; content:"|0b|hummforexxx|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iconpilot.com (Malware_Distribution)"; content:"|09|iconpilot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infantilsmoher.com (Malware_Infectors)"; content:"|0e|infantilsmoher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ingeniasistemas.cl (Malware_Infectors)"; content:"|0f|ingeniasistemas|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iphone4cost.info (Malware_Distribution)"; content:"|0b|iphone4cost|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j01zt.tk (Malware_Distribution)"; content:"|05|j01zt|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabropa.com (Malware_Infectors)"; content:"|07|jabropa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jorped.com (Malware_Distribution)"; content:"|06|jorped|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpq8i.tk (Malware_Distribution)"; content:"|05|jpq8i|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyxyvikujeq.com (Spyware)"; content:"|0b|jyxyvikujeq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kabahofeqem.com (Spyware)"; content:"|0b|kabahofeqem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kexejykobyz.com (Spyware)"; content:"|0b|kexejykobyz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kexigulat.com (Spyware)"; content:"|09|kexigulat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keylogit.com (Malware_Distribution)"; content:"|08|keylogit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krytykapolityczna.pl (Malware_Infectors)"; content:"|11|krytykapolityczna|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kusexynogemi.com (Spyware)"; content:"|0c|kusexynogemi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kynugypenihyf.com (Spyware)"; content:"|0d|kynugypenihyf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup levelai.com (Malware_Distribution)"; content:"|07|levelai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lolitka.pl (Malware_Distribution)"; content:"|07|lolitka|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m-alshoq.com (Malware_Distribution)"; content:"|08|m-alshoq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maids365services.com (Malware_Distribution)"; content:"|10|maids365services|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maidsprosweep.com (Malware_Distribution)"; content:"|0d|maidsprosweep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainupdatestoday.info (Malware_Distribution)"; content:"|10|mainupdatestoday|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mifugo.go.tz (Malware_Infectors)"; content:"|06|mifugo|02|go|02|tz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muzikstil.ucoz.ru (Malware_Infectors)"; content:"|09|muzikstil|04|ucoz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ne83m.tk (Malware_Distribution)"; content:"|05|ne83m|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nightwebx.tk (Malware_Distribution)"; content:"|09|nightwebx|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nizokatahinery.com (Spyware)"; content:"|0e|nizokatahinery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nopirekuz.com (Spyware)"; content:"|09|nopirekuz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noqukadifoxe.com (Spyware)"; content:"|0c|noqukadifoxe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup o9xkq.tk (Malware_Distribution)"; content:"|05|o9xkq|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pack.akilligroup.com (Malware_Distribution)"; content:"|04|pack|0b|akilligroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patysopublicidade.com (Malware_Distribution)"; content:"|11|patysopublicidade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paueducation.com (Malware_Infectors)"; content:"|0c|paueducation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup penavare.com (Malware_Distribution)"; content:"|08|penavare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinoc.org (Malware_Distribution)"; content:"|05|pinoc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porevoinetolkodlyatebya.info (Malware_Infectors)"; content:"|17|porevoinetolkodlyatebya|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pozimetycurenu.com (Spyware)"; content:"|0e|pozimetycurenu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pozimuvadaqyz.com (Spyware)"; content:"|0d|pozimuvadaqyz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premium-support2011.com (Spyware)"; content:"|13|premium-support2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prviral.com (Malware_Distribution)"; content:"|07|prviral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pubyhixasuhu.com (Spyware)"; content:"|0c|pubyhixasuhu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pududigulerewy.com (Spyware)"; content:"|0e|pududigulerewy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pulavytige.com (Spyware)"; content:"|0a|pulavytige|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puthillaryontheticket.com (Malware_Distribution)"; content:"|15|puthillaryontheticket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reverseengineeringtraining.com (Malware_Distribution)"; content:"|1a|reverseengineeringtraining|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup school-omar.com (Malware_Distribution)"; content:"|0b|school-omar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server.ve.gp (Malware_Distribution)"; content:"|06|server|02|ve|02|gp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexmovie4.tk (Malware_Distribution)"; content:"|09|sexmovie4|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexvakti.com (Malware_Infectors)"; content:"|08|sexvakti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smokecd.in (Malware_Distribution)"; content:"|07|smokecd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socialmediaexplorer.com (Malware_Infectors)"; content:"|13|socialmediaexplorer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swebfri.tk (Malware_Distribution)"; content:"|07|swebfri|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sxtrader.net (Malware_Distribution)"; content:"|08|sxtrader|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemguide.ru (Malware_Distribution)"; content:"|0b|systemguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup szybkikredyt.co.uk (Malware_Infectors)"; content:"|0c|szybkikredyt|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thsonline.org (Malware_Infectors)"; content:"|09|thsonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tjktv.net (Malware_Infectors)"; content:"|05|tjktv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tracymuck.com (Malware_Infectors)"; content:"|09|tracymuck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uploadtak.com (Malware_Infectors)"; content:"|09|uploadtak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urgente.warbe.org (Malware_Infectors)"; content:"|07|urgente|05|warbe|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webbysexzyx.tk (Malware_Distribution)"; content:"|0b|webbysexzyx|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup willi27.1x.net (Malware_Distribution)"; content:"|07|willi27|02|1x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpkadvogados.net (Malware_Infectors)"; content:"|0c|wpkadvogados|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xetpoo.com (Malware_Distribution)"; content:"|06|xetpoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xslhp.tk (Malware_Distribution)"; content:"|05|xslhp|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yakita.net (Botnet_C&C)"; content:"|06|yakita|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yaos.vx8.ru (Malware_Infectors)"; content:"|04|yaos|03|vx8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yekedenizcilik.com.tr (Malware_Distribution)"; content:"|0e|yekedenizcilik|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youare.sexidude.com (Zeus_Zbot_SpyEye)"; content:"|06|youare|08|sexidude|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yozqnewnacion.com (Malware_Infectors)"; content:"|0d|yozqnewnacion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yusungtech.co.kr (Malware_Distribution)"; content:"|0a|yusungtech|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaredivdudku2.com (Zeus_Zbot_SpyEye)"; content:"|0d|zaredivdudku2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoneck.com ()"; content:"|06|zoneck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoneft.com ()"; content:"|06|zoneft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zonehs.com ()"; content:"|06|zonehs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zonejm.com ()"; content:"|06|zonejm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoomchat.net ()"; content:"|08|zoomchat|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zykufareqybo.com (Malware_Distribution)"; content:"|0c|zykufareqybo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup podfer.com (Malware_Distribution)"; content:"|06|podfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pukfer.com (Malware_Distribution)"; content:"|06|pukfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup triskell-productions.com (Malware_Distribution)"; content:"|14|triskell-productions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unexpo.org (Malware_Distribution)"; content:"|06|unexpo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8minutedating.com ()"; content:"|0d|8minutedating|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abadora.ru ()"; content:"|07|abadora|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abccornet.com (Botnet_C&C)"; content:"|09|abccornet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allinoneprogmon.net (Botnet_C&C)"; content:"|0f|allinoneprogmon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amegatech.net ()"; content:"|09|amegatech|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antgreece.info ()"; content:"|09|antgreece|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apartliberal.com (Botnet_C&C)"; content:"|0c|apartliberal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artvolley.info ()"; content:"|09|artvolley|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup balkanpropertyservices.co.uk (Malware_Distribution)"; content:"|16|balkanpropertyservices|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdcoast.com ()"; content:"|07|bdcoast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup befiest.com ()"; content:"|07|befiest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biggamemonitoring.com ()"; content:"|11|biggamemonitoring|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigkeystore.com ()"; content:"|0b|bigkeystore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bill.ru ()"; content:"|04|bill|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blenderartists.org ()"; content:"|0e|blenderartists|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogsmonitoringservice.com ()"; content:"|16|blogsmonitoringservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmwcars.1.vg (Zeus_Zbot_SpyEye)"; content:"|07|bmwcars|01|1|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bolbos.co.cc (Zeus_Zbot_SpyEye)"; content:"|06|bolbos|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonusforall.net (Botnet_C&C)"; content:"|0b|bonusforall|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookknowlege.com ()"; content:"|0c|bookknowlege|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booster.estr.es (Zeus_Zbot_SpyEye)"; content:"|07|booster|04|estr|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bordernation.in (Botnet_C&C)"; content:"|0c|bordernation|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup borderspot.in (Botnet_C&C)"; content:"|0a|borderspot|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brainbox.dyndns.org ()"; content:"|08|brainbox|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunizywytyg.com (Spyware)"; content:"|0b|bunizywytyg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byqizawoto.com (Spyware)"; content:"|0a|byqizawoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byvovajisem.com (Spyware)"; content:"|0b|byvovajisem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capitalinformer.com (Botnet_C&C)"; content:"|0f|capitalinformer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ch01cilewk.com ()"; content:"|0a|ch01cilewk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkforsec.com (Botnet_C&C)"; content:"|0b|checkforsec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cl0wn-world.com ()"; content:"|0b|cl0wn-world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup concetpwow.com (Botnet_C&C)"; content:"|0a|concetpwow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosmicupdate.com ()"; content:"|0c|cosmicupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup costslaid.com (Botnet_C&C)"; content:"|09|costslaid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cr0wd-wal1.com ()"; content:"|0a|cr0wd-wal1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crj71ki813ck.com ()"; content:"|0c|crj71ki813ck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cryoiist7g.com ()"; content:"|0a|cryoiist7g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolbyaudiodevice.com ()"; content:"|10|dolbyaudiodevice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup favdstgssdqdsfg.start.tl (Malware_Distribution)"; content:"|0f|favdstgssdqdsfg|05|start|02|tl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fineandchic.com ()"; content:"|0b|fineandchic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freenetgameonline.com ()"; content:"|11|freenetgameonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamecomes.org (Botnet_C&C)"; content:"|09|gamecomes|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gnarenyawr.com ()"; content:"|0a|gnarenyawr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtracking.org (Botnet_C&C)"; content:"|09|gtracking|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup help-me-please.com ()"; content:"|0e|help-me-please|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herocopter.com (Botnet_C&C)"; content:"|0a|herocopter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes0.com (Malware_Infectors)"; content:"|0a|himynemes0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes1.com (Malware_Infectors)"; content:"|0a|himynemes1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes2.com (Malware_Infectors)"; content:"|0a|himynemes2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes3.com (Malware_Infectors)"; content:"|0a|himynemes3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes4.com (Malware_Infectors)"; content:"|0a|himynemes4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes5.com (Malware_Infectors)"; content:"|0a|himynemes5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes6.com (Malware_Infectors)"; content:"|0a|himynemes6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes7.com (Malware_Infectors)"; content:"|0a|himynemes7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes8.com (Malware_Infectors)"; content:"|0a|himynemes8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himynemes9.com (Malware_Infectors)"; content:"|0a|himynemes9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hybridenforum.com (Botnet_C&C)"; content:"|0d|hybridenforum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iamprotectedfrom.net (Botnet_C&C)"; content:"|10|iamprotectedfrom|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idpay.com ()"; content:"|05|idpay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagesharehost.com (Botnet_C&C)"; content:"|0e|imagesharehost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indanetwall.net (Botnet_C&C)"; content:"|0b|indanetwall|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infernomag.com (Botnet_C&C)"; content:"|0a|infernomag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intronetech.com (Botnet_C&C)"; content:"|0b|intronetech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jesusonlynet.org (Botnet_C&C)"; content:"|0c|jesusonlynet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jukdoout0.com ()"; content:"|09|jukdoout0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jurismaster.ru ()"; content:"|0b|jurismaster|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaskot.ru ()"; content:"|06|kaskot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kooerheel.com (Malware_Infectors)"; content:"|09|kooerheel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koolmacheel.com (Malware_Infectors)"; content:"|0b|koolmacheel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koolmdbvrdl.com (Malware_Infectors)"; content:"|0b|koolmdbvrdl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koolmevsel.com (Malware_Infectors)"; content:"|0a|koolmevsel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koolmmemeel.com (Malware_Infectors)"; content:"|0b|koolmmemeel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koolmvesel.com (Malware_Infectors)"; content:"|0a|koolmvesel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kysumiqehu.com (Spyware)"; content:"|0a|kysumiqehu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kytelaticik.com (Spyware)"; content:"|0b|kytelaticik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kyxiteruk.com (Spyware)"; content:"|09|kyxiteruk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laqoduhisegu.com (Spyware)"; content:"|0c|laqoduhisegu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lawujocot.com (Spyware)"; content:"|09|lawujocot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lefurasacaveta.com (Spyware)"; content:"|0e|lefurasacaveta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lelopifyqevaz.com (Spyware)"; content:"|0d|lelopifyqevaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifereward-l0tery.com ()"; content:"|11|lifereward-l0tery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lit0graphy-type.com ()"; content:"|0f|lit0graphy-type|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luckyhosting.org (Botnet_C&C)"; content:"|0c|luckyhosting|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masterproweb.net (Botnet_C&C)"; content:"|0c|masterproweb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdmonit.com ()"; content:"|07|mdmonit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metromanias.com (Botnet_C&C)"; content:"|0b|metromanias|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup missingsync.net (Botnet_C&C)"; content:"|0b|missingsync|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morolifuhahel.com (Spyware)"; content:"|0d|morolifuhahel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motherboardstest.com ()"; content:"|10|motherboardstest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movysokocuko.com (Spyware)"; content:"|0c|movysokocuko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mrjeep.info ()"; content:"|06|mrjeep|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtuconnectwall.org (Botnet_C&C)"; content:"|0e|mtuconnectwall|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mujalizyb.com (Spyware)"; content:"|09|mujalizyb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muqyxukuzopino.com (Spyware)"; content:"|0e|muqyxukuzopino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mutidajil.com (Spyware)"; content:"|09|mutidajil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mynyzyxyrofizo.com (Spyware)"; content:"|0e|mynyzyxyrofizo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywwwarchive.com ()"; content:"|0c|mywwwarchive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naxucerybaqecy.com (Spyware)"; content:"|0e|naxucerybaqecy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nebonenavygu.com (Spyware)"; content:"|0c|nebonenavygu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup necupyzugebo.com (Spyware)"; content:"|0c|necupyzugebo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn0.com (Malware_Infectors)"; content:"|09|nelainnn0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn1.com (Malware_Infectors)"; content:"|09|nelainnn1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn2.com (Malware_Infectors)"; content:"|09|nelainnn2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn3.com (Malware_Infectors)"; content:"|09|nelainnn3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn4.com (Malware_Infectors)"; content:"|09|nelainnn4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn5.com (Malware_Infectors)"; content:"|09|nelainnn5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn6.com (Malware_Infectors)"; content:"|09|nelainnn6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn7.com (Malware_Infectors)"; content:"|09|nelainnn7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn8.com (Malware_Infectors)"; content:"|09|nelainnn8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelainnn9.com (Malware_Infectors)"; content:"|09|nelainnn9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nevehaqyxixocu.com (Spyware)"; content:"|0e|nevehaqyxixocu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nilinijyf.com (Spyware)"; content:"|09|nilinijyf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nipygevydor.com (Spyware)"; content:"|0b|nipygevydor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nivyragami.com (Spyware)"; content:"|0a|nivyragami|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novoclientevangogh.com (Phishing_and_Theft)"; content:"|12|novoclientevangogh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omniwebpro.org ()"; content:"|0a|omniwebpro|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pay-for-order.com ()"; content:"|0d|pay-for-order|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcdocpro.com ()"; content:"|08|pcdocpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protechere.com (Botnet_C&C)"; content:"|0a|protechere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qrtyp0ngt0st.com ()"; content:"|0c|qrtyp0ngt0st|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qudeteyuj.cn ()"; content:"|09|qudeteyuj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ranmjyuke.com ()"; content:"|09|ranmjyuke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup re-customer.com ()"; content:"|0b|re-customer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readytoride.su ()"; content:"|0b|readytoride|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reportedtechniques.org (Botnet_C&C)"; content:"|12|reportedtechniques|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rinderwayr.com ()"; content:"|0a|rinderwayr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrhxilokmjytnlmy.com (Zeus_Zbot_SpyEye)"; content:"|10|rrhxilokmjytnlmy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salez-help.com ()"; content:"|0a|salez-help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-wonder.com ()"; content:"|0d|search-wonder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securemywebconnection.com ()"; content:"|15|securemywebconnection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup send2000.com ()"; content:"|08|send2000|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup severalcamp.com (Botnet_C&C)"; content:"|0b|severalcamp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sslabssys.com (Botnet_C&C)"; content:"|09|sslabssys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stimul-cash.com ()"; content:"|0b|stimul-cash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stimulcash.com ()"; content:"|0a|stimulcash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swltcho0.com ()"; content:"|08|swltcho0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup term0l5ter12.com ()"; content:"|0c|term0l5ter12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup termoi5terl2.com ()"; content:"|0c|termoi5terl2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testpcdriversonline.com ()"; content:"|13|testpcdriversonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackallnet.com (Botnet_C&C)"; content:"|0b|trackallnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficsources.org (Botnet_C&C)"; content:"|0e|trafficsources|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trialworld.net (Botnet_C&C)"; content:"|0a|trialworld|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twiceseparate.com (Botnet_C&C)"; content:"|0d|twiceseparate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twowayserf.com (Botnet_C&C)"; content:"|0a|twowayserf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uioimnuy3c.com ()"; content:"|0a|uioimnuy3c|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ul0lmnuy2k.com ()"; content:"|0a|ul0lmnuy2k|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup underbuild.net (Botnet_C&C)"; content:"|0a|underbuild|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vertumag.net (Botnet_C&C)"; content:"|08|vertumag|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtualmapping.org (Botnet_C&C)"; content:"|0e|virtualmapping|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voictoall.com (Botnet_C&C)"; content:"|09|voictoall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webstore-solutions.biz ()"; content:"|12|webstore-solutions|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wolkininet.net ()"; content:"|0a|wolkininet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpkadvogados.info (Phishing_and_Theft)"; content:"|0c|wpkadvogados|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xinmin.cn ()"; content:"|06|xinmin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xy95.cn ()"; content:"|04|xy95|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourorderhere.com ()"; content:"|0d|yourorderhere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursecurebilling.com ()"; content:"|11|yoursecurebilling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zz87jhfda88.com ()"; content:"|0b|zz87jhfda88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addcounters.com (Malware_Distribution)"; content:"|0b|addcounters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afivegreenscan.com (Spyware)"; content:"|0e|afivegreenscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup andriigrytsenko.net (Malware_Infectors)"; content:"|0f|andriigrytsenko|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispantispycastle.com (Fake_AV)"; content:"|13|antispantispycastle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispantispycastle.net (Fake_AV)"; content:"|13|antispantispycastle|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-defender.net (Fake_AV)"; content:"|10|antispy-defender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-firewall.com (Fake_AV)"; content:"|14|antispyware-firewall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-frame.com (Fake_AV)"; content:"|11|antispyware-frame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-home-2010.com (Fake_AV)"; content:"|15|antispyware-home-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-home.com (Fake_AV)"; content:"|10|antispyware-home|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-load.com (Fake_AV)"; content:"|10|antispyware-load|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-master.com (Fake_AV)"; content:"|12|antispyware-master|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-my-protection.com (Fake_AV)"; content:"|19|antispyware-my-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-my-scanner.com (Fake_AV)"; content:"|16|antispyware-my-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-myupdate.com (Fake_AV)"; content:"|14|antispyware-myupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-novelty.com (Fake_AV)"; content:"|13|antispyware-novelty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-scann.com (Fake_AV)"; content:"|11|antispyware-scann|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-update.com (Fake_AV)"; content:"|12|antispyware-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-win32-64.com (Fake_AV)"; content:"|14|antispyware-win32-64|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareexclusive.com (Fake_AV)"; content:"|14|antispywareexclusive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareexclver.com (Fake_AV)"; content:"|12|antispywareexclver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareexe.com (Fake_AV)"; content:"|0e|antispywareexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarehome2010.com (Fake_AV)"; content:"|13|antispywarehome2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarenewver.com (Fake_AV)"; content:"|11|antispywarenewver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarenewzip.com (Fake_AV)"; content:"|11|antispywarenewzip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywaresetupexe.com (Fake_AV)"; content:"|13|antispywaresetupexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareuses.com (Fake_AV)"; content:"|0f|antispywareuses|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarewin.com (Fake_AV)"; content:"|0e|antispywarewin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareworldsetup.com (Fake_AV)"; content:"|15|antispywareworldsetup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-product.net (Fake_AV)"; content:"|0f|antivir-product|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviractive.net (Fake_AV)"; content:"|0d|antiviractive|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirmore.net (Fake_AV)"; content:"|0b|antivirmore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirstat.net (Fake_AV)"; content:"|0b|antivirstat|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basementrenovationcontractors.com (Malware_Infectors)"; content:"|1d|basementrenovationcontractors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bayjail.ru (Malware_Infectors)"; content:"|07|bayjail|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bentmerchant.com (Malware_Distribution)"; content:"|0c|bentmerchant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bgrandomized.info (Malware_Infectors)"; content:"|0c|bgrandomized|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizzproffi.com (Malware_Infectors)"; content:"|0a|bizzproffi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bka.im ()"; content:"|03|bka|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blazedgefire.com (Botnet_C&C)"; content:"|0c|blazedgefire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogcourse.in (Botnet_C&C)"; content:"|0a|blogcourse|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bubblesphere.in (Botnet_C&C)"; content:"|0c|bubblesphere|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burdensoftrock.com (Botnet_C&C)"; content:"|0e|burdensoftrock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cali10ny.us (Botnet_C&C)"; content:"|08|cali10ny|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cali11ny.us (Botnet_C&C)"; content:"|08|cali11ny|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cali12ny.us (Botnet_C&C)"; content:"|08|cali12ny|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cali4ny.us (Botnet_C&C)"; content:"|07|cali4ny|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camihiss.in (Botnet_C&C)"; content:"|08|camihiss|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camilium.in (Botnet_C&C)"; content:"|08|camilium|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caradrive.net (Botnet_C&C)"; content:"|09|caradrive|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cazino-game.com ()"; content:"|0b|cazino-game|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clan-as.org (Malware_Infectors)"; content:"|07|clan-as|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clubtraxteloksuper.ru (Malware_Infectors)"; content:"|12|clubtraxteloksuper|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cn89212.com (Malware_Infectors)"; content:"|07|cn89212|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolblender.ru (Malware_Infectors)"; content:"|0b|coolblender|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cujicaraso.com (Spyware)"; content:"|0a|cujicaraso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxim.asia ()"; content:"|04|cxim|04|asia"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cylakydugudi.com (Spyware)"; content:"|0c|cylakydugudi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dafatesomyz.com (Spyware)"; content:"|0b|dafatesomyz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddumasz.info ()"; content:"|07|ddumasz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diadiemvietnam.com (Spyware)"; content:"|0e|diadiemvietnam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discountprowatch.com (Malware_Infectors)"; content:"|10|discountprowatch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup druf.dyndns.org (Zeus_Zbot_SpyEye)"; content:"|04|druf|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etopala2.com (Zeus_Zbot_SpyEye)"; content:"|08|etopala2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastprosearch.com ()"; content:"|0d|fastprosearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftpshki.cc (Malware_Infectors)"; content:"|07|ftpshki|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghjavsonline.com (Spyware)"; content:"|0c|ghjavsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globdomain.ru ()"; content:"|0a|globdomain|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gofegucobeqevi.com (Spyware)"; content:"|0e|gofegucobeqevi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gokuzajylot.com (Spyware)"; content:"|0b|gokuzajylot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlesyndiscation.com (Malware_Distribution)"; content:"|12|googlesyndiscation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gopaqajuwevul.com (Spyware)"; content:"|0d|gopaqajuwevul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gyxgmdn.co.tv (Malware_Infectors)"; content:"|07|gyxgmdn|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackzona.tk ()"; content:"|08|hackzona|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjwbxhqr.cn (Malware_Infectors)"; content:"|08|hjwbxhqr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotgas.ru (Malware_Infectors)"; content:"|06|hotgas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hovucytoc.com (Spyware)"; content:"|09|hovucytoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huwyzoluxa.com (Spyware)"; content:"|0a|huwyzoluxa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hydezerirevy.com (Spyware)"; content:"|0c|hydezerirevy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hydyfiliduzun.com (Spyware)"; content:"|0d|hydyfiliduzun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hymofakokazoz.com (Spyware)"; content:"|0d|hymofakokazoz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hytyvuweso.com (Spyware)"; content:"|0a|hytyvuweso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyvijinymut.com (Spyware)"; content:"|0b|hyvijinymut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idukadyzi.com (Spyware)"; content:"|09|idukadyzi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iluwalulas.com (Spyware)"; content:"|0a|iluwalulas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imaginarylife.org (Spyware)"; content:"|0d|imaginarylife|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indep29.com ()"; content:"|07|indep29|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irs-report-link.com (Malware_Infectors)"; content:"|0f|irs-report-link|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jafuwadycylew.com (Spyware)"; content:"|0d|jafuwadycylew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jafybobik.com (Spyware)"; content:"|09|jafybobik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jakkaru.ru ()"; content:"|07|jakkaru|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup janekennedynp.com (Malware_Infectors)"; content:"|0d|janekennedynp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup japefapap.com (Spyware)"; content:"|09|japefapap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jarntauiuva91.com ()"; content:"|0d|jarntauiuva91|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jarynokab.com (Spyware)"; content:"|09|jarynokab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jawynuvejeqini.com (Spyware)"; content:"|0e|jawynuvejeqini|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jazafibyho.com (Spyware)"; content:"|0a|jazafibyho|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jebuponip.com (Spyware)"; content:"|09|jebuponip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jeqovejurejel.com (Spyware)"; content:"|0d|jeqovejurejel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jicohewihihot.com (Spyware)"; content:"|0d|jicohewihihot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jilibilidedibabka.co.cc (Zeus_Zbot_SpyEye)"; content:"|11|jilibilidedibabka|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jiqixylexut.com (Spyware)"; content:"|0b|jiqixylexut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jocemufeb.com (Spyware)"; content:"|09|jocemufeb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joquwemixonav.com (Spyware)"; content:"|0d|joquwemixonav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jozogypipuwy.com (Spyware)"; content:"|0c|jozogypipuwy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jujupavynyxu.com (Spyware)"; content:"|0c|jujupavynyxu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup julejunageboj.com (Spyware)"; content:"|0d|julejunageboj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jumonevetode.com (Spyware)"; content:"|0c|jumonevetode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup k0x.ru ()"; content:"|03|k0x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kandagarka.net ()"; content:"|0a|kandagarka|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kdbhhhgsdjsb.cx.cc (Malware_Infectors)"; content:"|0c|kdbhhhgsdjsb|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kusika911.ru ()"; content:"|09|kusika911|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laafleur.com (Malware_Infectors)"; content:"|08|laafleur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup light.raystats.com ()"; content:"|05|light|08|raystats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linksfinder.net (Spyware)"; content:"|0b|linksfinder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lodfewpleaser.com (Malware_Infectors)"; content:"|0d|lodfewpleaser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup losefmosef777.net (Malware_Infectors)"; content:"|0d|losefmosef777|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaavivideoporevo.ru (Malware_Infectors)"; content:"|12|megaavivideoporevo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmslive.info ()"; content:"|07|mmslive|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mov-condor.com.ar (Malware_Infectors)"; content:"|0a|mov-condor|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multaka-baghdede.com (Malware_Infectors)"; content:"|10|multaka-baghdede|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myhomeantispyware.com (Fake_AV)"; content:"|11|myhomeantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myhomeantivirus.com (Fake_AV)"; content:"|0f|myhomeantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myprodjs.ru ()"; content:"|08|myprodjs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mytvhere.com ()"; content:"|08|mytvhere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nemohuildifsd.ru ()"; content:"|0d|nemohuildifsd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newantispywarerar.com (Fake_AV)"; content:"|11|newantispywarerar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omegantivir.com (Fake_AV)"; content:"|0b|omegantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinejobsnet.co.cc ()"; content:"|0d|onlinejobsnet|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osrty.com (Malware_Distribution)"; content:"|05|osrty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overpro.ru (Malware_Infectors)"; content:"|07|overpro|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phonevideoxxxx.info (Malware_Infectors)"; content:"|0e|phonevideoxxxx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pkodeft.co.tv (Malware_Infectors)"; content:"|07|pkodeft|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup platinumantispyware.com (Fake_AV)"; content:"|13|platinumantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portable-antispyware.com (Fake_AV)"; content:"|14|portable-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prava-servise.ru ()"; content:"|0d|prava-servise|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup preflopp.com (Malware_Infectors)"; content:"|08|preflopp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proobizz.cc (Malware_Infectors)"; content:"|08|proobizz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pupseg.tv ()"; content:"|06|pupseg|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qabupowibi.com (Spyware)"; content:"|0a|qabupowibi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qamuvidobihu.com (Spyware)"; content:"|0c|qamuvidobihu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qehynytezyn.com (Spyware)"; content:"|0b|qehynytezyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qepovexidysopy.com (Spyware)"; content:"|0e|qepovexidysopy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qetyviwygo.com (Spyware)"; content:"|0a|qetyviwygo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qiculeqity.com (Spyware)"; content:"|0a|qiculeqity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raptag.ru (Zeus_Zbot_SpyEye)"; content:"|06|raptag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rarantispyware.com (Fake_AV)"; content:"|0e|rarantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rodcmshws.co.be (Malware_Distribution)"; content:"|09|rodcmshws|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sa-ppas12.com (Malware_Infectors)"; content:"|09|sa-ppas12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scdqnklsfds.com (Malware_Infectors)"; content:"|0b|scdqnklsfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securepaid.biz (Malware_Infectors)"; content:"|0a|securepaid|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitycourses.com (Spyware)"; content:"|0f|securitycourses|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setup-antispyware.com (Fake_AV)"; content:"|11|setup-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sicha-linna8.com (Malware_Infectors)"; content:"|0c|sicha-linna8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sivassigorta.com (Botnet_C&C)"; content:"|0c|sivassigorta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-antispyware.com (Fake_AV)"; content:"|11|smart-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softvb.com (Malware_Infectors)"; content:"|06|softvb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sourcegoogle.com (Malware_Distribution)"; content:"|0c|sourcegoogle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statcount.cn (Malware_Infectors)"; content:"|09|statcount|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys-antispyware.com (Fake_AV)"; content:"|0f|sys-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tech-antispyware.com (Fake_AV)"; content:"|10|tech-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup technol-antispyware.com (Fake_AV)"; content:"|13|technol-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup technology-antispyware.com (Fake_AV)"; content:"|16|technology-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teencantryit.us ()"; content:"|0c|teencantryit|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-goodlike.com ()"; content:"|0c|the-goodlike|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestversionantispyware.com (Fake_AV)"; content:"|19|thebestversionantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tibiafiles.com (Malware_Infectors)"; content:"|0a|tibiafiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topwnnsoft.tk (Spyware)"; content:"|0a|topwnnsoft|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffbaer.com (Spyware)"; content:"|09|traffbaer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tunemug.ru (Malware_Infectors)"; content:"|07|tunemug|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhjjs.com (Malware_Infectors)"; content:"|05|uhjjs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimblock.com (Spyware)"; content:"|0a|ultimblock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimdefender.com (Spyware)"; content:"|0d|ultimdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultrarua.com (Malware_Infectors)"; content:"|08|ultrarua|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upstracks.com (Zeus_Zbot_SpyEye)"; content:"|09|upstracks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vipemobi.com (Botnet_C&C)"; content:"|08|vipemobi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtualartsonline.com (Botnet_C&C)"; content:"|11|virtualartsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vr.zeus2010.net (Zeus_Zbot_SpyEye)"; content:"|02|vr|08|zeus2010|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vurmo-st6.cn (Malware_Infectors)"; content:"|09|vurmo-st6|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wallantispyware.com (Fake_AV)"; content:"|0f|wallantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webantispy.net (Fake_AV)"; content:"|0a|webantispy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webovu.com (Botnet_C&C)"; content:"|06|webovu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webovu.in (Botnet_C&C)"; content:"|06|webovu|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webtazzy.in (Botnet_C&C)"; content:"|08|webtazzy|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webyakivee.in (Botnet_C&C)"; content:"|0a|webyakivee|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webzadel.in (Botnet_C&C)"; content:"|08|webzadel|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weqnext.com (Zeus_Zbot_SpyEye)"; content:"|07|weqnext|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windos8.net (Spyware)"; content:"|07|windos8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winpals.com (Botnet_C&C)"; content:"|07|winpals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wirelessmortgages.com (Botnet_C&C)"; content:"|11|wirelessmortgages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wirelessmortgages.in (Botnet_C&C)"; content:"|11|wirelessmortgages|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wizardslounge.net (Botnet_C&C)"; content:"|0d|wizardslounge|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worddirect.in (Botnet_C&C)"; content:"|0a|worddirect|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup write-dream.ru ()"; content:"|0b|write-dream|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpressoxo.com (Botnet_C&C)"; content:"|09|xpressoxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zenybijywyrade.com (Spyware)"; content:"|0e|zenybijywyrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziigmmn.com (Zeus_Zbot_SpyEye)"; content:"|07|ziigmmn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zinatevyd.com (Spyware)"; content:"|09|zinatevyd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zinomyzom.com (Spyware)"; content:"|09|zinomyzom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zipantispyware.com (Fake_AV)"; content:"|0e|zipantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zonotunev.com (Spyware)"; content:"|09|zonotunev|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zotaziweboxe.com (Spyware)"; content:"|0c|zotaziweboxe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zubaidas.com.pk (Malware_Distribution)"; content:"|08|zubaidas|03|com|02|pk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zucypibyrum.com (Spyware)"; content:"|0b|zucypibyrum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zufonabubi.com (Spyware)"; content:"|0a|zufonabubi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zutiqasinexoq.com (Spyware)"; content:"|0d|zutiqasinexoq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zuvydisul.com (Spyware)"; content:"|09|zuvydisul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zuzosahule.com (Spyware)"; content:"|0a|zuzosahule|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zycumuxofux.com (Spyware)"; content:"|0b|zycumuxofux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3010928.02.com.tw (Malware_Distribution)"; content:"|07|3010928|02|02|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 32gdjfkivcf.co.cc (Malware_Distribution)"; content:"|0b|32gdjfkivcf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rezidencia.com (Malware_Distribution)"; content:"|0a|rezidencia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xomcui.com (Malware_Distribution)"; content:"|06|xomcui|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geopopulation.com ()"; content:"|0d|geopopulation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yanagi.co.kr (Malware_Distribution)"; content:"|06|yanagi|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wantedh2o.at (Malware_Distribution)"; content:"|09|wantedh2o|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0577yy.com (Spyware)"; content:"|06|0577yy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0800fotograaf.nl (Malware_Distribution)"; content:"|0d|0800fotograaf|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 40hgubisbgbgw84b.com (Malware_Infectors)"; content:"|10|40hgubisbgbgw84b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 44qwpoga.com (Zeus_Zbot_SpyEye)"; content:"|08|44qwpoga|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9fox.biz (Malware_Distribution)"; content:"|04|9fox|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aukro.ua (Zeus_Zbot_SpyEye)"; content:"|05|aukro|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autosputnik.com (Malware_Distribution)"; content:"|0b|autosputnik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsgowin.com (Spyware)"; content:"|08|avsgowin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avspridewinxp.com (Spyware)"; content:"|0d|avspridewinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avspridewinxponline.com (Spyware)"; content:"|13|avspridewinxponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banner-count.com (Malware_Infectors)"; content:"|0c|banner-count|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbredstar.com (Malware_Infectors)"; content:"|09|bbredstar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup birdievspridewin.com (Spyware)"; content:"|10|birdievspridewin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizavids.com (Malware_Distribution)"; content:"|08|bizavids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buburuzka.com (Malware_Distribution)"; content:"|09|buburuzka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catchtime.co.kr (Malware_Distribution)"; content:"|09|catchtime|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup channeltrb123trb.com (Zeus_Zbot_SpyEye)"; content:"|10|channeltrb123trb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkservicenow.ru (Zeus_Zbot_SpyEye)"; content:"|0f|checkservicenow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coculixuvyhiti.com (Spyware)"; content:"|0e|coculixuvyhiti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cptyiu.cx.cc (Malware_Infectors)"; content:"|06|cptyiu|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creditbureauexperts.com (Spyware)"; content:"|13|creditbureauexperts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakifoheli.com (Spyware)"; content:"|0a|dakifoheli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dalebihyku.com (Spyware)"; content:"|0a|dalebihyku|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daralytagyc.com (Spyware)"; content:"|0b|daralytagyc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decufysohyh.com (Spyware)"; content:"|0b|decufysohyh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detajilap.com (Spyware)"; content:"|09|detajilap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dexiwotenelex.com (Spyware)"; content:"|0d|dexiwotenelex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dezycuhuqelyg.com (Spyware)"; content:"|0d|dezycuhuqelyg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgamb.ru (Spyware)"; content:"|05|dgamb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dihemehypuq.com (Spyware)"; content:"|0b|dihemehypuq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dijipabamefuw.com (Spyware)"; content:"|0d|dijipabamefuw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diqowybyfaf.com (Spyware)"; content:"|0b|diqowybyfaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup divinemeb.com (Spyware)"; content:"|09|divinemeb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dopifoqetucol.com (Spyware)"; content:"|0d|dopifoqetucol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotecukihilavy.com (Spyware)"; content:"|0e|dotecukihilavy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doughaa.com ()"; content:"|07|doughaa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebwiiad.co.tv (Malware_Distribution)"; content:"|07|ebwiiad|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edataplanet.in (Malware_Infectors)"; content:"|0b|edataplanet|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enguzeloyunlar1.com (Malware_Infectors)"; content:"|0f|enguzeloyunlar1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enterhere2.biz (Zeus_Zbot_SpyEye)"; content:"|0a|enterhere2|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup envirysscanxp.com (Spyware)"; content:"|0d|envirysscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etopala3.com (Zeus_Zbot_SpyEye)"; content:"|08|etopala3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exfacebooks.com ()"; content:"|0b|exfacebooks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fatroll.cx.cc (Malware_Infectors)"; content:"|07|fatroll|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federal-secueity-goverment.com (Zeus_Zbot_SpyEye)"; content:"|1a|federal-secueity-goverment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstvaccine.co.kr (Malware_Distribution)"; content:"|0c|firstvaccine|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freakcan.ru (Zeus_Zbot_SpyEye)"; content:"|08|freakcan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigpornoforfree.ru (Spyware)"; content:"|0f|gigpornoforfree|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gll.info (Spyware)"; content:"|03|gll|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gocglesource.com (Spyware)"; content:"|0c|gocglesource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gooqleadcence.com (Spyware)"; content:"|0d|gooqleadcence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gruzakk.com ()"; content:"|07|gruzakk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gucyranodyanifo.ns0.it (Malware_Infectors)"; content:"|0f|gucyranodyanifo|03|ns0|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiddenseo.ru (Malware_Distribution)"; content:"|09|hiddenseo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highclear.co.kr (Malware_Distribution)"; content:"|09|highclear|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hornygirls.biz (Spyware)"; content:"|0a|hornygirls|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imadel.org (Malware_Distribution)"; content:"|06|imadel|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup investplan.info (Spyware)"; content:"|0a|investplan|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iphone5spyapp.org ()"; content:"|0d|iphone5spyapp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhjhygyug-uhg.com (Zeus_Zbot_SpyEye)"; content:"|0d|jhjhygyug-uhg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jongunn.gv.vg (Malware_Distribution)"; content:"|07|jongunn|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ka3ek2.com (Zeus_Zbot_SpyEye)"; content:"|06|ka3ek2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keepprivacy.co.kr (Malware_Distribution)"; content:"|0b|keepprivacy|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kk0lot0m.net (Spyware)"; content:"|08|kk0lot0m|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup libdnsmasq.com (Malware_Infectors)"; content:"|0a|libdnsmasq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manx.in (Malware_Distribution)"; content:"|04|manx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediamoreplugins.info (Malware_Distribution)"; content:"|10|mediamoreplugins|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediatoolparts.net (Malware_Distribution)"; content:"|0e|mediatoolparts|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediawidgetparts.net (Malware_Distribution)"; content:"|10|mediawidgetparts|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memehehz.info (Zeus_Zbot_SpyEye)"; content:"|08|memehehz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobile-files.com (Malware_Infectors)"; content:"|0c|mobile-files|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviefreeboard.com (Malware_Distribution)"; content:"|0e|moviefreeboard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavspridewin.com (Spyware)"; content:"|0d|myavspridewin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavspridewinxp.com (Spyware)"; content:"|0f|myavspridewinxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mygreatbar.com (Zeus_Zbot_SpyEye)"; content:"|0a|mygreatbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mzdbt.com (Malware_Distribution)"; content:"|05|mzdbt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nadersamar2.org (Zeus_Zbot_SpyEye)"; content:"|0b|nadersamar2|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nadnadzzz.info (Zeus_Zbot_SpyEye)"; content:"|09|nadnadzzz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup national-security-agency.com (Zeus_Zbot_SpyEye)"; content:"|18|national-security-agency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newavsgowin.com (Spyware)"; content:"|0b|newavsgowin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup npicture.net (Spyware)"; content:"|08|npicture|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privatecash.cc ()"; content:"|0b|privatecash|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protestsvirysscan.com (Spyware)"; content:"|11|protestsvirysscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proxim.ircgalaxy.pl (Zeus_Zbot_SpyEye)"; content:"|06|proxim|09|ircgalaxy|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quadrohdguard.com (Zeus_Zbot_SpyEye)"; content:"|0d|quadrohdguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup queryexplorer.com (Malware_Distribution)"; content:"|0d|queryexplorer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redirectica.com (Spyware)"; content:"|0b|redirectica|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchguard.co.kr (Malware_Distribution)"; content:"|0b|searchguard|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup senatevirysscanxp.com (Spyware)"; content:"|11|senatevirysscanxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shellybeachskiboatclub.co.za (Malware_Distribution)"; content:"|16|shellybeachskiboatclub|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shieldforcesecurity.com (Spyware)"; content:"|13|shieldforcesecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sidetab.co.kr (Malware_Distribution)"; content:"|07|sidetab|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitesbrasnet.com (Malware_Distribution)"; content:"|0c|sitesbrasnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skyoflies.info (Zeus_Zbot_SpyEye)"; content:"|09|skyoflies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartcripts.com ()"; content:"|0b|smartcripts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sms1000.co.kr (Malware_Distribution)"; content:"|07|sms1000|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soja.nosty.su (Zeus_Zbot_SpyEye)"; content:"|04|soja|05|nosty|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starinfoworld.in (Malware_Infectors)"; content:"|0d|starinfoworld|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starmovie-plus.com (Malware_Distribution)"; content:"|0e|starmovie-plus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storagemovie-online.biz (Malware_Distribution)"; content:"|13|storagemovie-online|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supnewdmn.com (Zeus_Zbot_SpyEye)"; content:"|09|supnewdmn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sxkoubei.gv.vg (Malware_Distribution)"; content:"|08|sxkoubei|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup symconempkr.com (Zeus_Zbot_SpyEye)"; content:"|0b|symconempkr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tds-vip-monster.com (Malware_Infectors)"; content:"|0f|tds-vip-monster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teristorinc.com (Malware_Distribution)"; content:"|0b|teristorinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themyproxy.info (Spyware)"; content:"|0a|themyproxy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tlaloc666.com (Zeus_Zbot_SpyEye)"; content:"|09|tlaloc666|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toriebesisefou.ns0.it (Malware_Infectors)"; content:"|0e|toriebesisefou|03|ns0|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tppkuban.ru (Malware_Distribution)"; content:"|08|tppkuban|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube178-video.servepics.com (Malware_Infectors)"; content:"|0d|tube178-video|09|servepics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ucheckconfig.info (Malware_Distribution)"; content:"|0c|ucheckconfig|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhjgswbufds.com (Malware_Distribution)"; content:"|0b|uhjgswbufds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ups.1gb.ru (Malware_Distribution)"; content:"|03|ups|03|1gb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vejpongosot.com (Malware_Distribution)"; content:"|0b|vejpongosot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vihuhosyde.com (Spyware)"; content:"|0a|vihuhosyde|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vijytijybi.com (Spyware)"; content:"|0a|vijytijybi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vivigozymekox.com (Spyware)"; content:"|0d|vivigozymekox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vocenuncaviu.sytes.net (Malware_Distribution)"; content:"|0c|vocenuncaviu|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vogunemymyko.com (Spyware)"; content:"|0c|vogunemymyko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vojocokipy.com (Spyware)"; content:"|0a|vojocokipy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vokixehimal.com (Spyware)"; content:"|0b|vokixehimal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vse-wam.ru (Malware_Infectors)"; content:"|07|vse-wam|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuqigajab.com (Spyware)"; content:"|09|vuqigajab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vusysogirebymy.com (Spyware)"; content:"|0e|vusysogirebymy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuxipupuhaz.com (Spyware)"; content:"|0b|vuxipupuhaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vygazykeke.com (Spyware)"; content:"|0a|vygazykeke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vyzaraputifyb.com (Spyware)"; content:"|0d|vyzaraputifyb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waqexiroqej.com (Spyware)"; content:"|0b|waqexiroqej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warupegacotate.com (Spyware)"; content:"|0e|warupegacotate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wavupinycom.com (Spyware)"; content:"|0b|wavupinycom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weail.wdect.ru (Zeus_Zbot_SpyEye)"; content:"|05|weail|05|wdect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wegebenirahu.com (Spyware)"; content:"|0c|wegebenirahu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weightsoft.in (Malware_Distribution)"; content:"|0a|weightsoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wevecohesikyv.com (Spyware)"; content:"|0d|wevecohesikyv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wewibolyxov.com (Spyware)"; content:"|0b|wewibolyxov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whattheheck.net.in (Malware_Distribution)"; content:"|0b|whattheheck|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup white-bacon.cx.cc (Malware_Infectors)"; content:"|0b|white-bacon|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windkodexp.ru (Malware_Distribution)"; content:"|0a|windkodexp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows.litefun.com (Zeus_Zbot_SpyEye)"; content:"|07|windows|07|litefun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsmedia.net.in (Zeus_Zbot_SpyEye)"; content:"|0c|windowsmedia|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winsekureservo.co.cc (Zeus_Zbot_SpyEye)"; content:"|0e|winsekureservo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wipujuvajyr.com (Spyware)"; content:"|0b|wipujuvajyr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wisevaccine.co.kr (Malware_Distribution)"; content:"|0b|wisevaccine|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wisigudyniqixo.com (Spyware)"; content:"|0e|wisigudyniqixo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wobyfyvovafew.com (Spyware)"; content:"|0d|wobyfyvovafew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woqugotyn.com (Spyware)"; content:"|09|woqugotyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wozireracy.com (Spyware)"; content:"|0a|wozireracy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpesoko.co.tv (Malware_Distribution)"; content:"|07|wpesoko|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wujyvonoke.com (Spyware)"; content:"|0a|wujyvonoke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wuqulenyropoc.com (Spyware)"; content:"|0d|wuqulenyropoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wurokalawysusa.com (Spyware)"; content:"|0e|wurokalawysusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wutai1.hackkorea.com (Malware_Distribution)"; content:"|06|wutai1|09|hackkorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wybydunugyra.com (Spyware)"; content:"|0c|wybydunugyra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wyciwywyt.com (Spyware)"; content:"|09|wyciwywyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wygehasunupi.com (Spyware)"; content:"|0c|wygehasunupi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wylyxaqunowy.com (Spyware)"; content:"|0c|wylyxaqunowy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcarma.ru (Spyware)"; content:"|06|xcarma|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xylocomoda.com (Zeus_Zbot_SpyEye)"; content:"|0a|xylocomoda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyriwaryfuwy.com (Spyware)"; content:"|0c|xyriwaryfuwy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyseditacif.com (Spyware)"; content:"|0b|xyseditacif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xysutylapekepo.com (Spyware)"; content:"|0e|xysutylapekepo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyxukinasacujo.com (Spyware)"; content:"|0e|xyxukinasacujo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yalupa.com (Zeus_Zbot_SpyEye)"; content:"|06|yalupa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytigosuvi.com (Spyware)"; content:"|09|ytigosuvi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ywaxeweq.com (Spyware)"; content:"|08|ywaxeweq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zabininetele.com (Spyware)"; content:"|0c|zabininetele|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zakikipyr.com (Spyware)"; content:"|09|zakikipyr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zazykizyref.com (Spyware)"; content:"|0b|zazykizyref|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zinkzo.com (Malware_Distribution)"; content:"|06|zinkzo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zondgroup.com (Malware_Distribution)"; content:"|09|zondgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zyfovubyv.com (Spyware)"; content:"|09|zyfovubyv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zyjicasotopib.com (Spyware)"; content:"|0d|zyjicasotopib|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zymujidysi.com (Spyware)"; content:"|0a|zymujidysi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zysuzasyfage.com (Spyware)"; content:"|0c|zysuzasyfage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zytamygac.com (Spyware)"; content:"|09|zytamygac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kanika.ru (Malware_Distribution)"; content:"|06|kanika|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 404error.in (Malware_Distribution)"; content:"|08|404error|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aabioqeafds.com (Malware_Infectors)"; content:"|0b|aabioqeafds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accutaneeffects.com (Malware_Distribution)"; content:"|0f|accutaneeffects|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aefxmusafds.com (Malware_Infectors)"; content:"|0b|aefxmusafds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aegoblin.com (Malware_Distribution)"; content:"|08|aegoblin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghabguafds.com (Malware_Infectors)"; content:"|0b|aghabguafds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agicdvdmstorage.net (Malware_Distribution)"; content:"|0f|agicdvdmstorage|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajicpcwafds.com (Malware_Infectors)"; content:"|0b|ajicpcwafds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anneou.in (Malware_Distribution)"; content:"|06|anneou|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anysexlife.net (Malware_Distribution)"; content:"|0a|anysexlife|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arcalebe.in (Malware_Distribution)"; content:"|08|arcalebe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arhyv.ru (Malware_Infectors)"; content:"|05|arhyv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assink.in (Malware_Distribution)"; content:"|06|assink|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsfeelwin.com (Spyware)"; content:"|0a|avsfeelwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bakagunaxepo.com (Fake_AV)"; content:"|0c|bakagunaxepo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bipuwyqojivu.com (Malware_Distribution)"; content:"|0c|bipuwyqojivu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blermili.in (Malware_Distribution)"; content:"|08|blermili|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boqerorune.com (Fake_AV)"; content:"|0a|boqerorune|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cacre.es (Malware_Distribution)"; content:"|05|cacre|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cadulovocagat.com (Malware_Distribution)"; content:"|0d|cadulovocagat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cafidylyjilox.com (Malware_Distribution)"; content:"|0d|cafidylyjilox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cajezuleneziny.com (Malware_Distribution)"; content:"|0e|cajezuleneziny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cejygyluh.com (Spyware)"; content:"|09|cejygyluh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chatsmeebo.in (Botnet_C&C)"; content:"|0a|chatsmeebo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup check-antispyware.com (Fake_AV)"; content:"|11|check-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chorale-sainte-cecile.com (Malware_Distribution)"; content:"|15|chorale-sainte-cecile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cicabijyni.com (Spyware)"; content:"|0a|cicabijyni|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cilywelohy.com (Spyware)"; content:"|0a|cilywelohy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cinuherijugeg.com (Malware_Distribution)"; content:"|0d|cinuherijugeg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup civivicuqekexo.com (Malware_Distribution)"; content:"|0e|civivicuqekexo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cocineon.in (Malware_Distribution)"; content:"|08|cocineon|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codsvr.com (Malware_Distribution)"; content:"|06|codsvr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cogimbee.in (Botnet_C&C)"; content:"|08|cogimbee|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cogistug.in (Botnet_C&C)"; content:"|08|cogistug|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comantispyware.com (Fake_AV)"; content:"|0e|comantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comstockxs.com (Botnet_C&C)"; content:"|0a|comstockxs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup control-panel-antivirus-scan.com (Fake_AV)"; content:"|1c|control-panel-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counv.ru (Malware_Infectors)"; content:"|05|counv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coyieldo.in (Botnet_C&C)"; content:"|08|coyieldo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cubadirecto.es (Malware_Distribution)"; content:"|0b|cubadirecto|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyhajodyhotolo.com (Malware_Distribution)"; content:"|0e|cyhajodyhotolo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup davemosyku.com (Malware_Distribution)"; content:"|0a|davemosyku|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dazzleshare.in (Botnet_C&C)"; content:"|0b|dazzleshare|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dedarmen.nl (Malware_Distribution)"; content:"|08|dedarmen|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dekyzymykir.com (Malware_Distribution)"; content:"|0b|dekyzymykir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dempsre.com (Botnet_C&C)"; content:"|07|dempsre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup devtube.in (Botnet_C&C)"; content:"|07|devtube|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diathbsp.in (Malware_Distribution)"; content:"|08|diathbsp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digartcenter.com (Botnet_C&C)"; content:"|0c|digartcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digiaugusta.in (Botnet_C&C)"; content:"|0b|digiaugusta|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digiput.net (Botnet_C&C)"; content:"|07|digiput|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digital-protection-software.com (Spyware)"; content:"|1b|digital-protection-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalpackpack.in (Botnet_C&C)"; content:"|0f|digitalpackpack|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalstatues.in (Botnet_C&C)"; content:"|0e|digitalstatues|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup disqusware.in (Botnet_C&C)"; content:"|0a|disqusware|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnsposition.com (Zeus_Zbot_SpyEye)"; content:"|0b|dnsposition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadzip-antispyware.com (Fake_AV)"; content:"|17|downloadzip-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsadsa.dyndns.org (Malware_Distribution)"; content:"|06|dsadsa|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dualvaccine.com (Malware_Distribution)"; content:"|0b|dualvaccine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dugaryjymi.com (Spyware)"; content:"|0a|dugaryjymi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duresasatipa.com (Spyware)"; content:"|0c|duresasatipa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dutyziriryvi.com (Spyware)"; content:"|0c|dutyziriryvi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duvizazuz.com (Spyware)"; content:"|09|duvizazuz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dyfosinyfileti.com (Spyware)"; content:"|0e|dyfosinyfileti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynander.in (Botnet_C&C)"; content:"|08|dynander|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dypolarosateve.com (Spyware)"; content:"|0e|dypolarosateve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earlyanswered.com (Botnet_C&C)"; content:"|0d|earlyanswered|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edgeaim.in (Botnet_C&C)"; content:"|07|edgeaim|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup engine-antispyware.com (Fake_AV)"; content:"|12|engine-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epibbler.in (Malware_Distribution)"; content:"|08|epibbler|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estatefire.in (Botnet_C&C)"; content:"|0a|estatefire|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evnagivu.com (Botnet_C&C)"; content:"|08|evnagivu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evnvu.net (Botnet_C&C)"; content:"|05|evnvu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exeantispyware.com (Fake_AV)"; content:"|0e|exeantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exero.eu (Malware_Infectors)"; content:"|05|exero|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebookjusl.com (Malware_Distribution)"; content:"|0c|facebookjusl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebooksay.com (Malware_Distribution)"; content:"|0b|facebooksay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastlives.com (Botnet_C&C)"; content:"|09|fastlives|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fbcabkuffds.com (Malware_Infectors)"; content:"|0b|fbcabkuffds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup febysaholubaro.com (Spyware)"; content:"|0e|febysaholubaro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fercon.ro (Malware_Distribution)"; content:"|06|fercon|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firthwo.in (Malware_Distribution)"; content:"|07|firthwo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashchatgroup.in (Botnet_C&C)"; content:"|0e|flashchatgroup|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashspot.in (Botnet_C&C)"; content:"|09|flashspot|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashutilites.in (Botnet_C&C)"; content:"|0d|flashutilites|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flipdog.in (Botnet_C&C)"; content:"|07|flipdog|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flipdogtags.com (Botnet_C&C)"; content:"|0b|flipdogtags|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup followupezio.net (Botnet_C&C)"; content:"|0c|followupezio|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fopuvuwupode.com (Malware_Distribution)"; content:"|0c|fopuvuwupode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup formedtouch.com (Botnet_C&C)"; content:"|0b|formedtouch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foto-paper.com (Malware_Distribution)"; content:"|0a|foto-paper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fourware.in (Botnet_C&C)"; content:"|08|fourware|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fourware.net (Botnet_C&C)"; content:"|08|fourware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeartscenter.com (Botnet_C&C)"; content:"|0e|freeartscenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freefilesarchive.in (Botnet_C&C)"; content:"|10|freefilesarchive|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeflashutilites.in (Botnet_C&C)"; content:"|11|freeflashutilites|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freelanceagreement.in (Botnet_C&C)"; content:"|12|freelanceagreement|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freemedia-plus.com (Malware_Distribution)"; content:"|0e|freemedia-plus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freevoodoo.in (Botnet_C&C)"; content:"|0a|freevoodoo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freevoodoo.net (Botnet_C&C)"; content:"|0a|freevoodoo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup futerktwoireut.com (Spyware)"; content:"|0e|futerktwoireut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabcircle.com (Botnet_C&C)"; content:"|09|gabcircle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamersite.org (Malware_Distribution)"; content:"|09|gamersite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gefscrngfds.com (Malware_Infectors)"; content:"|0b|gefscrngfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghjqndlgfds.com (Malware_Infectors)"; content:"|0b|ghjqndlgfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gipupeceta.com (Fake_AV)"; content:"|0a|gipupeceta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldseriesantispyware.com (Fake_AV)"; content:"|15|goldseriesantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gooqlepics.com (Malware_Infectors)"; content:"|0a|gooqlepics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grand-antispyware.com (Fake_AV)"; content:"|11|grand-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grouphours.com (Zeus_Zbot_SpyEye)"; content:"|0a|grouphours|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hehyvixiru.com (Fake_AV)"; content:"|0a|hehyvixiru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hemusyheduf.com (Fake_AV)"; content:"|0b|hemusyheduf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hisesuloh.com (Malware_Distribution)"; content:"|09|hisesuloh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hmarhelo.com (Zeus_Zbot_SpyEye)"; content:"|08|hmarhelo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hobolamitajy.com (Malware_Distribution)"; content:"|0c|hobolamitajy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeantispyware.com (Fake_AV)"; content:"|0f|homeantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homepcantispyware.com (Fake_AV)"; content:"|11|homepcantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hxdxyz0om.com (Malware_Distribution)"; content:"|09|hxdxyz0om|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-antispyware.com (Fake_AV)"; content:"|14|internet-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iphone5spyware.org ()"; content:"|0e|iphone5spyware|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iphone5tracker.org ()"; content:"|0e|iphone5tracker|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jcdgsdbjfds.com (Malware_Infectors)"; content:"|0b|jcdgsdbjfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jelenarozga.fileave.com (Malware_Distribution)"; content:"|0b|jelenarozga|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetuqaroxos.com (Malware_Distribution)"; content:"|0b|jetuqaroxos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jocojihuc.com (Fake_AV)"; content:"|09|jocojihuc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyxirafyhulora.com (Malware_Distribution)"; content:"|0e|jyxirafyhulora|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keywordkr.com (Zeus_Zbot_SpyEye)"; content:"|09|keywordkr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kysymysafamy.com (Malware_Distribution)"; content:"|0c|kysymysafamy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kytoside.in (Malware_Distribution)"; content:"|08|kytoside|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ledimajezociw.com (Malware_Distribution)"; content:"|0d|ledimajezociw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup levulehup.com (Malware_Distribution)"; content:"|09|levulehup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup levysavasezo.com (Malware_Distribution)"; content:"|0c|levysavasezo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lfgythtlfds.com (Malware_Infectors)"; content:"|0b|lfgythtlfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luyto.ru (Fake_AV)"; content:"|05|luyto|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mailantispyware.com (Fake_AV)"; content:"|0f|mailantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makepan.in (Malware_Distribution)"; content:"|07|makepan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masterantispyware.com (Fake_AV)"; content:"|11|masterantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaarchivschoolporno.ru (Malware_Distribution)"; content:"|15|megaarchivschoolporno|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mghuqcpmfds.com (Malware_Infectors)"; content:"|0b|mghuqcpmfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mohijyxazyby.com (Malware_Distribution)"; content:"|0c|mohijyxazyby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-antispyware-update.com (Fake_AV)"; content:"|15|my-antispyware-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-check-antispyware.com (Fake_AV)"; content:"|14|my-check-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-computer-www-scan.com (Spyware)"; content:"|14|my-computer-www-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-doc-antispyware.com (Fake_AV)"; content:"|12|my-doc-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-doctor-antispyware.com (Fake_AV)"; content:"|15|my-doctor-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-pc-antispyware.com (Fake_AV)"; content:"|11|my-pc-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-smart-antispyware.com (Fake_AV)"; content:"|14|my-smart-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-update-antispyware.com (Fake_AV)"; content:"|15|my-update-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantispywarescan.com (Fake_AV)"; content:"|11|myantispywarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycoresep.com (Malware_Distribution)"; content:"|09|mycoresep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfacebooknnb.com (Malware_Distribution)"; content:"|0d|myfacebooknnb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nagwa.mooo.com (Zeus_Zbot_SpyEye)"; content:"|05|nagwa|04|mooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nali.guys4us.net (Zeus_Zbot_SpyEye)"; content:"|04|nali|07|guys4us|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup narorudyzezow.com (Malware_Distribution)"; content:"|0d|narorudyzezow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nazufakefecym.com (Malware_Distribution)"; content:"|0d|nazufakefecym|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newstrucks.com (Zeus_Zbot_SpyEye)"; content:"|0a|newstrucks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nigyruqyn.com (Fake_AV)"; content:"|09|nigyruqyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nipoloquv.com (Malware_Distribution)"; content:"|09|nipoloquv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nishthamedispa.com (Malware_Distribution)"; content:"|0e|nishthamedispa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nituxygusu.com (Malware_Distribution)"; content:"|0a|nituxygusu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nodes.com.ua (Zeus_Zbot_SpyEye)"; content:"|05|nodes|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nonavs.com (Spyware)"; content:"|06|nonavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nucawatufuxuwi.com (Malware_Distribution)"; content:"|0e|nucawatufuxuwi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyharucukom.com (Malware_Distribution)"; content:"|0b|nyharucukom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyxoxuxezy.com (Malware_Distribution)"; content:"|0a|nyxoxuxezy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup od.hotfashion.biz (Zeus_Zbot_SpyEye)"; content:"|02|od|0a|hotfashion|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odourie.in (Malware_Distribution)"; content:"|07|odourie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup own-mediaload.com (Malware_Distribution)"; content:"|0d|own-mediaload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pafozykavygaj.com (Malware_Distribution)"; content:"|0d|pafozykavygaj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panchitox.laweb.es (Zeus_Zbot_SpyEye)"; content:"|09|panchitox|05|laweb|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup papucky.eu (Malware_Infectors)"; content:"|07|papucky|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parta.q8still.net (Zeus_Zbot_SpyEye)"; content:"|05|parta|07|q8still|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patopato.info (Zeus_Zbot_SpyEye)"; content:"|08|patopato|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pejozehywe.com (Malware_Distribution)"; content:"|0a|pejozehywe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup penchatox.sin-ip.es (Zeus_Zbot_SpyEye)"; content:"|09|penchatox|06|sin-ip|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photo-facebooks.com (Malware_Distribution)"; content:"|0f|photo-facebooks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photobucketd.com (Malware_Distribution)"; content:"|0c|photobucketd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pianrejpfds.com (Malware_Infectors)"; content:"|0b|pianrejpfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pisowyxuwisin.com (Malware_Distribution)"; content:"|0d|pisowyxuwisin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piyahan.com (Malware_Distribution)"; content:"|07|piyahan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pomexyposenebi.com (Malware_Distribution)"; content:"|0e|pomexyposenebi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poopthree.com (Zeus_Zbot_SpyEye)"; content:"|09|poopthree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntubebiz.org (Fake_AV)"; content:"|0b|porntubebiz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pylabarywip.com (Malware_Distribution)"; content:"|0b|pylabarywip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qilogewyc.com (Malware_Distribution)"; content:"|09|qilogewyc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qojijixiwidaz.com (Malware_Distribution)"; content:"|0d|qojijixiwidaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qotasifelaw.com (Malware_Distribution)"; content:"|0b|qotasifelaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rabuqibareme.com (Malware_Distribution)"; content:"|0c|rabuqibareme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rbecsvz.co.tv (Malware_Distribution)"; content:"|07|rbecsvz|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retisuqat.com (Malware_Distribution)"; content:"|09|retisuqat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rijucyvybumyka.com (Malware_Distribution)"; content:"|0e|rijucyvybumyka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruqonivyja.com (Malware_Distribution)"; content:"|0a|ruqonivyja|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scdldsgsfds.com (Malware_Infectors)"; content:"|0b|scdldsgsfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexajuruvesik.com (Malware_Distribution)"; content:"|0d|sexajuruvesik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sivycaqilugoq.com (Malware_Distribution)"; content:"|0d|sivycaqilugoq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sosexytube.com (Malware_Infectors)"; content:"|0a|sosexytube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sosutstudentxxx.ru (Malware_Distribution)"; content:"|0f|sosutstudentxxx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumatevebat.com (Fake_AV)"; content:"|0b|sumatevebat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susubbs.com (Malware_Infectors)"; content:"|07|susubbs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suzehebaq.com (Malware_Distribution)"; content:"|09|suzehebaq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syqivolurypugi.com (Malware_Distribution)"; content:"|0e|syqivolurypugi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysigicigisav.com (Malware_Distribution)"; content:"|0d|sysigicigisav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sywedidaqugef.com (Malware_Distribution)"; content:"|0d|sywedidaqugef|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t0werh4sp0w3r.fileave.com (Malware_Distribution)"; content:"|0d|t0werh4sp0w3r|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tawil.biz (Zeus_Zbot_SpyEye)"; content:"|05|tawil|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ter09nter-th4j.com (Fake_AV)"; content:"|0e|ter09nter-th4j|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testhard-itbloc.tk (Malware_Distribution)"; content:"|0f|testhard-itbloc|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantivirysscan.com (Fake_AV)"; content:"|10|theantivirysscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup therealityglove.com (Malware_Distribution)"; content:"|0f|therealityglove|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thousandmilitary.com (Botnet_C&C)"; content:"|10|thousandmilitary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tibumuqel.com (Malware_Distribution)"; content:"|09|tibumuqel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todayxclipszfm.tk (Malware_Distribution)"; content:"|0e|todayxclipszfm|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todizubosox.com (Malware_Distribution)"; content:"|0b|todizubosox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficstatsonline.net (Malware_Distribution)"; content:"|12|trafficstatsonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup travelmeant.net (Botnet_C&C)"; content:"|0b|travelmeant|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traxnochyustudent.ru (Malware_Distribution)"; content:"|11|traxnochyustudent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube198-videos.redirectme.net (Malware_Distribution)"; content:"|0e|tube198-videos|0a|redirectme|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube299-flash.servepics.com (Malware_Distribution)"; content:"|0d|tube299-flash|09|servepics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tudidawajyvaf.com (Malware_Distribution)"; content:"|0d|tudidawajyvaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tysyzapobuvy.com (Malware_Distribution)"; content:"|0c|tysyzapobuvy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unders.in (Malware_Distribution)"; content:"|06|unders|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vawinofemu.com (Spyware)"; content:"|0a|vawinofemu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vehyraceke.com (Spyware)"; content:"|0a|vehyraceke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup venkasexisdeffki.ru (Malware_Distribution)"; content:"|10|venkasexisdeffki|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verynicetube.com (Malware_Infectors)"; content:"|0c|verynicetube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verynucetube.net (Malware_Infectors)"; content:"|0c|verynucetube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vetidicawisos.com (Spyware)"; content:"|0d|vetidicawisos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vezegavor.com (Spyware)"; content:"|09|vezegavor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vyrogoxofem.com (Malware_Distribution)"; content:"|0b|vyrogoxofem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waciroqohuli.com (Malware_Distribution)"; content:"|0c|waciroqohuli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup walibukyqa.com (Malware_Distribution)"; content:"|0a|walibukyqa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wapuqiqaqom.com (Malware_Distribution)"; content:"|0b|wapuqiqaqom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup willysy.com (Malware_Infectors)"; content:"|07|willysy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wisetrize.com (Zeus_Zbot_SpyEye)"; content:"|09|wisetrize|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup witywypihag.com (Malware_Distribution)"; content:"|0b|witywypihag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wudicofez.com (Malware_Distribution)"; content:"|09|wudicofez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wybuzyrywovaj.com (Malware_Distribution)"; content:"|0d|wybuzyrywovaj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wycecikodovi.com (Malware_Distribution)"; content:"|0c|wycecikodovi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xarerecus.com (Spyware)"; content:"|09|xarerecus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xecuhuziqys.com (Malware_Distribution)"; content:"|0b|xecuhuziqys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xegunider.com (Malware_Distribution)"; content:"|09|xegunider|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xibipijuxoj.com (Spyware)"; content:"|0b|xibipijuxoj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xipifexegybozi.com (Malware_Distribution)"; content:"|0e|xipifexegybozi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xitytusahysese.com (Spyware)"; content:"|0e|xitytusahysese|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xixeriwihat.com (Spyware)"; content:"|0b|xixeriwihat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xofokusutecyd.com (Spyware)"; content:"|0d|xofokusutecyd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xojalyfudux.com (Spyware)"; content:"|0b|xojalyfudux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xucysasowebaty.com (Malware_Distribution)"; content:"|0e|xucysasowebaty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xufytoqujumydu.com (Spyware)"; content:"|0e|xufytoqujumydu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xumanipuw.com (Spyware)"; content:"|09|xumanipuw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xuryfacaqy.com (Malware_Distribution)"; content:"|0a|xuryfacaqy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyfefaviwamela.com (Spyware)"; content:"|0e|xyfefaviwamela|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xykecolun.com (Spyware)"; content:"|09|xykecolun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yandekapi.com (Malware_Infectors)"; content:"|09|yandekapi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yecla1.com (Malware_Distribution)"; content:"|06|yecla1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ykacojohodiuhas.linkpc.net (Malware_Distribution)"; content:"|0f|ykacojohodiuhas|06|linkpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youcanfixit.pc-emt-online.com (Malware_Distribution)"; content:"|0b|youcanfixit|0d|pc-emt-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zarapetahuryp.com (Fake_AV)"; content:"|0d|zarapetahuryp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zhopaseksporno.ru (Malware_Distribution)"; content:"|0e|zhopaseksporno|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zificefydyn.com (Fake_AV)"; content:"|0b|zificefydyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zomypufavinij.com (Malware_Distribution)"; content:"|0d|zomypufavinij|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zukifinyve.com (Malware_Distribution)"; content:"|0a|zukifinyve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zyzanewodojyx.com (Fake_AV)"; content:"|0d|zyzanewodojyx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlesyndicetion.com (Malware_Distribution)"; content:"|11|googlesyndicetion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indochito.biz (Malware_Distribution)"; content:"|09|indochito|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup varzan111.co.cc (Malware_Distribution)"; content:"|09|varzan111|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-volunteer.org.tw (Malware_Distribution)"; content:"|0b|e-volunteer|03|org|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monsterbux.ax3.net (Malware_Distribution)"; content:"|0a|monsterbux|03|ax3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edirneotokiralama.com (Malware_Distribution)"; content:"|11|edirneotokiralama|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hy2yuan.com (Malware_Distribution)"; content:"|07|hy2yuan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 054ng.info (Malware_Distribution)"; content:"|05|054ng|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alreadywire.com (Malware_Infectors)"; content:"|0b|alreadywire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bezlica.net (Phishing_and_Theft)"; content:"|07|bezlica|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtelevideochanel.com ()"; content:"|12|bigtelevideochanel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brightdog.net ()"; content:"|09|brightdog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camilium.net ()"; content:"|08|camilium|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkserverstatux.com ()"; content:"|11|checkserverstatux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cityzoo.ir (Zeus_Zbot_SpyEye)"; content:"|07|cityzoo|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coginix.org ()"; content:"|07|coginix|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cometfing.com (Malware_Distribution)"; content:"|09|cometfing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crqsluvnlqmjrpq.org (Zeus_Zbot_SpyEye)"; content:"|0f|crqsluvnlqmjrpq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup data-ero-advertising.com (Malware_Distribution)"; content:"|14|data-ero-advertising|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demible.net ()"; content:"|07|demible|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demicero.net ()"; content:"|08|demicero|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drlouxvsslqnsblv.org (Zeus_Zbot_SpyEye)"; content:"|10|drlouxvsslqnsblv|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eamia.net ()"; content:"|05|eamia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edgetune.net ()"; content:"|08|edgetune|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ero-advertising.com (Malware_Distribution)"; content:"|0f|ero-advertising|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eukmzlcpqg.co.tv (Malware_Distribution)"; content:"|0a|eukmzlcpqg|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euolrvmtnliwlp.info (Botnet_C&C)"; content:"|0e|euolrvmtnliwlp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fff43dfsfdsdfs.com (Malware_Distribution)"; content:"|0e|fff43dfsfdsdfs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fivetag.net ()"; content:"|07|fivetag|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fivevine.net ()"; content:"|08|fivevine|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flffrzveqflqso.org (Zeus_Zbot_SpyEye)"; content:"|0e|flffrzveqflqso|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup folikassol1l.com (Zeus_Zbot_SpyEye)"; content:"|0c|folikassol1l|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freetoooobe.net (Malware_Distribution)"; content:"|0b|freetoooobe|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fwhnsprvjqostrpl.com (Zeus_Zbot_SpyEye)"; content:"|10|fwhnsprvjqostrpl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabspan.net ()"; content:"|07|gabspan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ggvfhovtntysfotv.com (Botnet_C&C)"; content:"|10|ggvfhovtntysfotv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghppxfsrnetfpqq.biz (Zeus_Zbot_SpyEye)"; content:"|0f|ghppxfsrnetfpqq|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigaopia.net ()"; content:"|08|gigaopia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigaporntube2.com (Malware_Distribution)"; content:"|0d|gigaporntube2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigaporntube3.com (Malware_Distribution)"; content:"|0d|gigaporntube3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glsqoylxoxqeskoo.org (Zeus_Zbot_SpyEye)"; content:"|10|glsqoylxoxqeskoo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup granderiofm.com.br (Phishing_and_Theft)"; content:"|0b|granderiofm|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gxwiphvozjqkq.org (Zeus_Zbot_SpyEye)"; content:"|0d|gxwiphvozjqkq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gznwluzrbprapn.info (Zeus_Zbot_SpyEye)"; content:"|0e|gznwluzrbprapn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgnsktqmugker.biz (Zeus_Zbot_SpyEye)"; content:"|0d|hgnsktqmugker|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup http-harddrive.us (Malware_Infectors)"; content:"|0e|http-harddrive|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup http-mp3downloadtorrent.tk (Malware_Infectors)"; content:"|17|http-mp3downloadtorrent|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup http-networkrouteit.info (Malware_Infectors)"; content:"|13|http-networkrouteit|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup http-pcshop.co.cc (Malware_Infectors)"; content:"|0b|http-pcshop|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup http-programming.co.cc (Malware_Infectors)"; content:"|10|http-programming|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup http-securityguard.tk (Malware_Infectors)"; content:"|12|http-securityguard|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup http-tourismsea.tk (Malware_Infectors)"; content:"|0f|http-tourismsea|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpactive.net (Malware_Infectors)"; content:"|0a|httpactive|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpbuild.net (Malware_Infectors)"; content:"|09|httpbuild|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpbuyonline.net (Malware_Infectors)"; content:"|0d|httpbuyonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpdisk.net (Malware_Infectors)"; content:"|08|httpdisk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpdomain.net (Malware_Infectors)"; content:"|0a|httpdomain|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpexplore.net (Malware_Infectors)"; content:"|0b|httpexplore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpfield.net (Malware_Infectors)"; content:"|09|httpfield|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpgreen.net (Malware_Infectors)"; content:"|09|httpgreen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpipaddress.tk (Malware_Infectors)"; content:"|0d|httpipaddress|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httplightweb.eu (Malware_Infectors)"; content:"|0c|httplightweb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httplive.net (Malware_Infectors)"; content:"|08|httplive|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpload.com (Malware_Infectors)"; content:"|08|httpload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpnets.eu (Malware_Infectors)"; content:"|08|httpnets|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpnew.net (Malware_Infectors)"; content:"|07|httpnew|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpset.net (Malware_Infectors)"; content:"|07|httpset|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpsky.net (Malware_Infectors)"; content:"|07|httpsky|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpsolution.eu (Malware_Infectors)"; content:"|0c|httpsolution|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httptestip.tk (Malware_Infectors)"; content:"|0a|httptestip|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpweb.eu (Malware_Infectors)"; content:"|07|httpweb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpwebit.info (Malware_Infectors)"; content:"|09|httpwebit|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpwebworld.net (Malware_Infectors)"; content:"|0c|httpwebworld|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hvfjpojjlrqlovl.net (Zeus_Zbot_SpyEye)"; content:"|0f|hvfjpojjlrqlovl|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijsikjgbsg.ru (Malware_Distribution)"; content:"|0a|ijsikjgbsg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innolounge.net ()"; content:"|0a|innolounge|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insidestream.com (Malware_Distribution)"; content:"|0c|insidestream|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ioiopqqw.ru (Malware_Distribution)"; content:"|08|ioiopqqw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqservice.ir (Zeus_Zbot_SpyEye)"; content:"|09|iqservice|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jbnikqiqqmxuxejt.org (Zeus_Zbot_SpyEye)"; content:"|10|jbnikqiqqmxuxejt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jfdhbhfbfdbfd.ru (Malware_Distribution)"; content:"|0d|jfdhbhfbfdbfd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhvsbsbsb.ru (Malware_Distribution)"; content:"|09|jhvsbsbsb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jijiouurnq.ru (Malware_Distribution)"; content:"|0a|jijiouurnq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkjkjdecoecce.org (Malware_Distribution)"; content:"|0d|jkjkjdecoecce|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkxduovdqvkdmjoe.com (Zeus_Zbot_SpyEye)"; content:"|10|jkxduovdqvkdmjoe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johngottybest.com (Zeus_Zbot_SpyEye)"; content:"|0d|johngottybest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jqjqjqzxcbv.ru (Malware_Distribution)"; content:"|0b|jqjqjqzxcbv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jtcwrlkzqwmmsox.org (Zeus_Zbot_SpyEye)"; content:"|0f|jtcwrlkzqwmmsox|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kayauto.net (Malware_Distribution)"; content:"|07|kayauto|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaylith.net ()"; content:"|07|kaylith|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kdusqkjmtygtjoqt.org (Botnet_C&C)"; content:"|10|kdusqkjmtygtjoqt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kkjkcjhhche.org (Malware_Distribution)"; content:"|0b|kkjkcjhhche|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup komyhoocnjhmt.biz (Zeus_Zbot_SpyEye)"; content:"|0d|komyhoocnjhmt|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kvmdvdvdv.ru (Malware_Distribution)"; content:"|09|kvmdvdvdv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lgtslyonlonenfd.com (Zeus_Zbot_SpyEye)"; content:"|0f|lgtslyonlonenfd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkjdmvkkdm.ru (Malware_Distribution)"; content:"|0a|lkjdmvkkdm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lnpzygtmdjttskyy.info (Zeus_Zbot_SpyEye)"; content:"|10|lnpzygtmdjttskyy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup love-map.com (Malware_Distribution)"; content:"|08|love-map|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lstrpmitvrwiknw.com (Zeus_Zbot_SpyEye)"; content:"|0f|lstrpmitvrwiknw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lsvyovgwoptbjnwq.com (Zeus_Zbot_SpyEye)"; content:"|10|lsvyovgwoptbjnwq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mailssrvs.com (Zeus_Zbot_SpyEye)"; content:"|09|mailssrvs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mebelinfoteka.biz (Malware_Distribution)"; content:"|0d|mebelinfoteka|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minisdns.com (Zeus_Zbot_SpyEye)"; content:"|08|minisdns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motorssmonito.com (Malware_Distribution)"; content:"|0d|motorssmonito|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mqmsrryakhsorol.biz (Zeus_Zbot_SpyEye)"; content:"|0f|mqmsrryakhsorol|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mynamedomskis.com (Botnet_C&C)"; content:"|0d|mynamedomskis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mzwxnhkwrofuk.info (Botnet_C&C)"; content:"|0d|mzwxnhkwrofuk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkofart.net ()"; content:"|0c|networkofart|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ngpllvbqkhplrzrk.net (Zeus_Zbot_SpyEye)"; content:"|10|ngpllvbqkhplrzrk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njinhtmtlruuuhn.net (Zeus_Zbot_SpyEye)"; content:"|0f|njinhtmtlruuuhn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nmwhtkz.co.tv (Malware_Distribution)"; content:"|07|nmwhtkz|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nplqsufspnwmetm.info (Zeus_Zbot_SpyEye)"; content:"|0f|nplqsufspnwmetm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup npstssnicqxofned.org (Zeus_Zbot_SpyEye)"; content:"|10|npstssnicqxofned|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nullptr.ipq.co (Phishing_and_Theft)"; content:"|07|nullptr|03|ipq|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nutcrlrhisrqvi.info (Zeus_Zbot_SpyEye)"; content:"|0e|nutcrlrhisrqvi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nwemivnuswirnw.info (Zeus_Zbot_SpyEye)"; content:"|0e|nwemivnuswirnw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinerpornofree.net (Malware_Distribution)"; content:"|10|onlinerpornofree|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ookmojpzlmjkdfo.org (Zeus_Zbot_SpyEye)"; content:"|0f|ookmojpzlmjkdfo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osnvsnnxrlgpjzx.org (Zeus_Zbot_SpyEye)"; content:"|0f|osnvsnnxrlgpjzx|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oxkfpxjubvsfhrkx.info (Zeus_Zbot_SpyEye)"; content:"|10|oxkfpxjubvsfhrkx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panberty.com (Malware_Distribution)"; content:"|08|panberty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pihbinmhgpwjkpt.biz (Zeus_Zbot_SpyEye)"; content:"|0f|pihbinmhgpwjkpt|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjupkjmzznnykmg.info (Zeus_Zbot_SpyEye)"; content:"|0f|pjupkjmzznnykmg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promentions.xp3.biz (Zeus_Zbot_SpyEye)"; content:"|0b|promentions|03|xp3|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pslzsgfuenglvust.info (Zeus_Zbot_SpyEye)"; content:"|10|pslzsgfuenglvust|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjyqfyughpmkmin.org (Zeus_Zbot_SpyEye)"; content:"|0f|qjyqfyughpmkmin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qllzkesgqayjjj.biz (Zeus_Zbot_SpyEye)"; content:"|0e|qllzkesgqayjjj|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qnpasehann.gv.vg (Zeus_Zbot_SpyEye)"; content:"|0a|qnpasehann|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qplyooztllryohhb.info (Zeus_Zbot_SpyEye)"; content:"|10|qplyooztllryohhb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qsqdrnniomdrhjt.org (Zeus_Zbot_SpyEye)"; content:"|0f|qsqdrnniomdrhjt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quaveo.net ()"; content:"|06|quaveo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quilane.net ()"; content:"|07|quilane|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reckless.co.uk (Botnet_C&C)"; content:"|08|reckless|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup request4ns.com (Malware_Distribution)"; content:"|0a|request4ns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roombo.net ()"; content:"|06|roombo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roonyx.net ()"; content:"|06|roonyx|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seenbee.xp3.biz (Zeus_Zbot_SpyEye)"; content:"|07|seenbee|03|xp3|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sepyqezeno.com (Spyware)"; content:"|0a|sepyqezeno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sewibonypar.com (Spyware)"; content:"|0b|sewibonypar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sewicyzinuhe.com (Spyware)"; content:"|0c|sewicyzinuhe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sezixalekur.com (Spyware)"; content:"|0b|sezixalekur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sihorarofiqiha.com (Spyware)"; content:"|0e|sihorarofiqiha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjfsewojjvrqxpu.org (Zeus_Zbot_SpyEye)"; content:"|0f|sjfsewojjvrqxpu|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjohvoshbshbs.ru (Malware_Distribution)"; content:"|0d|sjohvoshbshbs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skriptbox.ru (Phishing_and_Theft)"; content:"|09|skriptbox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slqrjysjkljvn.org (Botnet_C&C)"; content:"|0d|slqrjysjkljvn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socihizizacowo.com (Spyware)"; content:"|0e|socihizizacowo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softconvert.biz (Spyware)"; content:"|0b|softconvert|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softconvert.com (Spyware)"; content:"|0b|softconvert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonewenazo.com (Spyware)"; content:"|0a|sonewenazo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sositawidapezi.com (Spyware)"; content:"|0e|sositawidapezi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sovejecogiqek.com (Spyware)"; content:"|0d|sovejecogiqek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sprqoffvslpjsqio.com (Zeus_Zbot_SpyEye)"; content:"|10|sprqoffvslpjsqio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suhthtmrrsqmve.info (Zeus_Zbot_SpyEye)"; content:"|0e|suhthtmrrsqmve|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sukanaf.com (Phishing_and_Theft)"; content:"|07|sukanaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sukanaf.net (Phishing_and_Theft)"; content:"|07|sukanaf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumywygifi.com (Spyware)"; content:"|0a|sumywygifi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susimumezez.com (Spyware)"; content:"|0b|susimumezez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suvsvhkfoutxuyu.info (Zeus_Zbot_SpyEye)"; content:"|0f|suvsvhkfoutxuyu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syxisesyf.com (Spyware)"; content:"|09|syxisesyf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syxityvik.com (Spyware)"; content:"|09|syxityvik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tapahagupaji.com (Spyware)"; content:"|0c|tapahagupaji|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxigibyz.com (Spyware)"; content:"|09|taxigibyz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup techsphere.co.th (Botnet_C&C)"; content:"|0a|techsphere|02|co|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tikytudububy.com (Spyware)"; content:"|0c|tikytudububy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timypahisoxur.com (Spyware)"; content:"|0d|timypahisoxur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tipagafyp.com (Spyware)"; content:"|09|tipagafyp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiwyzirydup.com (Spyware)"; content:"|0b|tiwyzirydup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tojutokubovu.com (Spyware)"; content:"|0c|tojutokubovu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tolkui.iwl.by (Phishing_and_Theft)"; content:"|06|tolkui|03|iwl|02|by"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topqnpasehann.cx.cc (Zeus_Zbot_SpyEye)"; content:"|0d|topqnpasehann|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tqqnvifkgplzdjw.info (Zeus_Zbot_SpyEye)"; content:"|0f|tqqnvifkgplzdjw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackingups.net (Malware_Distribution)"; content:"|0b|trackingups|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tracksups.net (Malware_Distribution)"; content:"|09|tracksups|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trihuyavzadnizu.ru (Malware_Distribution)"; content:"|0f|trihuyavzadnizu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truminfi.com ()"; content:"|08|truminfi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttqozgetnnumlgo.biz (Zeus_Zbot_SpyEye)"; content:"|0f|ttqozgetnnumlgo|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuvadovykavo.com (Spyware)"; content:"|0c|tuvadovykavo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twivu.net ()"; content:"|05|twivu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tydiligobev.com (Spyware)"; content:"|0b|tydiligobev|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyfifopojax.com (Spyware)"; content:"|0b|tyfifopojax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tynovunej.com (Spyware)"; content:"|09|tynovunej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ufgalvtubvf.com (Malware_Distribution)"; content:"|0b|ufgalvtubvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uipohfrqtspprj.org (Zeus_Zbot_SpyEye)"; content:"|0e|uipohfrqtspprj|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ursgdiylzsrjnjhu.com (Zeus_Zbot_SpyEye)"; content:"|10|ursgdiylzsrjnjhu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uvprpnoirijoqyss.org (Zeus_Zbot_SpyEye)"; content:"|10|uvprpnoirijoqyss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v34ggwww3ss0.com (Malware_Distribution)"; content:"|0c|v34ggwww3ss0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vobsejqvkmuqrbq.org (Zeus_Zbot_SpyEye)"; content:"|0f|vobsejqvkmuqrbq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrktcnsrpkkyrk.biz (Zeus_Zbot_SpyEye)"; content:"|0e|vrktcnsrpkkyrk|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsvsdvdvsd.ru (Malware_Distribution)"; content:"|0a|vsvsdvdvsd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsvynlupsftmzn.org (Botnet_C&C)"; content:"|0e|vsvynlupsftmzn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuniqvlztwmjgroj.biz (Zeus_Zbot_SpyEye)"; content:"|10|vuniqvlztwmjgroj|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvsspeed.gv.vg (Zeus_Zbot_SpyEye)"; content:"|08|vvsspeed|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-myworking.com (Malware_Infectors)"; content:"|0d|web-myworking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-sitecat.eu (Malware_Infectors)"; content:"|0b|web-sitecat|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-worldcars.us (Malware_Infectors)"; content:"|0d|web-worldcars|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websoft-pro.me (Malware_Infectors)"; content:"|0b|websoft-pro|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whakrxuonsqhrved.org (Zeus_Zbot_SpyEye)"; content:"|10|whakrxuonsqhrved|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup white-pc.info (Phishing_and_Theft)"; content:"|08|white-pc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whysohardx.com ()"; content:"|0a|whysohardx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wikifreetour.me (Malware_Distribution)"; content:"|0c|wikifreetour|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wikixo.net ()"; content:"|06|wikixo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wskizdxzsljjtpul.com (Zeus_Zbot_SpyEye)"; content:"|10|wskizdxzsljjtpul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x2.b0tx.com (Phishing_and_Theft)"; content:"|02|x2|04|b0tx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdns.freetzi.com (Zeus_Zbot_SpyEye)"; content:"|04|xdns|07|freetzi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xibudific.cn ()"; content:"|09|xibudific|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xkssurpwojespqkg.org (Zeus_Zbot_SpyEye)"; content:"|10|xkssurpwojespqkg|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xzbowuktxhqnsioh.org (Zeus_Zbot_SpyEye)"; content:"|10|xzbowuktxhqnsioh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ycnmmmxixzxrpgm.biz (Zeus_Zbot_SpyEye)"; content:"|0f|ycnmmmxixzxrpgm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ylgmflphjvpxtfed.org (Zeus_Zbot_SpyEye)"; content:"|10|ylgmflphjvpxtfed|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ypwjmxesxzxiivy.org (Zeus_Zbot_SpyEye)"; content:"|0f|ypwjmxesxzxiivy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yrqylohukpptvk.biz (Zeus_Zbot_SpyEye)"; content:"|0e|yrqylohukpptvk|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zrwtvvzpornemrl.biz (Zeus_Zbot_SpyEye)"; content:"|0f|zrwtvvzpornemrl|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zwkihcevxqvsrldx.org (Botnet_C&C)"; content:"|10|zwkihcevxqvsrldx|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awalstudios.com (Fake_AV)"; content:"|0b|awalstudios|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bastandro.in (Fake_AV)"; content:"|09|bastandro|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup batmanrobinho.com (Zeus_Zbot_SpyEye)"; content:"|0d|batmanrobinho|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedownloader2011.ru (Malware_Distribution)"; content:"|10|bedownloader2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bosinmeyarder.com (Zeus_Zbot_SpyEye)"; content:"|0d|bosinmeyarder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbcgiuacbvf.com (Zeus_Zbot_SpyEye)"; content:"|0b|cbcgiuacbvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comtoway.com (Malware_Infectors)"; content:"|08|comtoway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup danteloyaa.net (Malware_Infectors)"; content:"|0a|danteloyaa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddlnetwork.com (Malware_Infectors)"; content:"|0a|ddlnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demo.hireindians.net (Fake_AV)"; content:"|04|demo|0b|hireindians|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamondexchange2011.ru (Malware_Distribution)"; content:"|13|diamondexchange2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duote.com.cn (Malware_Infectors)"; content:"|05|duote|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earlyship.ru (Zeus_Zbot_SpyEye)"; content:"|09|earlyship|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eftopia.es (Malware_Infectors)"; content:"|07|eftopia|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eretywven.no-ip.biz (Malware_Infectors)"; content:"|09|eretywven|05|no-ip|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewingparkbmx2011.ru (Malware_Distribution)"; content:"|10|ewingparkbmx2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fakiwijow.com (Spyware)"; content:"|09|fakiwijow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faseguryfoh.com (Spyware)"; content:"|0b|faseguryfoh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fehosoxukyk.com (Spyware)"; content:"|0b|fehosoxukyk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fevahanybyvu.com (Spyware)"; content:"|0c|fevahanybyvu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fkoqrhrwwrlyummr.info (Zeus_Zbot_SpyEye)"; content:"|10|fkoqrhrwwrlyummr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foledahehofij.com (Spyware)"; content:"|0d|foledahehofij|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup folevonedubuc.com (Spyware)"; content:"|0d|folevonedubuc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup footballgirdles.tk (Fake_AV)"; content:"|0f|footballgirdles|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fsnqhbwhpzyvhqm.org (Zeus_Zbot_SpyEye)"; content:"|0f|fsnqhbwhpzyvhqm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftpnitepbnqzwwp.net (Zeus_Zbot_SpyEye)"; content:"|0f|ftpnitepbnqzwwp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fudejivuqaran.com (Spyware)"; content:"|0d|fudejivuqaran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fusipemura.com (Spyware)"; content:"|0a|fusipemura|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuxawekugygil.com (Spyware)"; content:"|0d|fuxawekugygil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuzugomaqeriwy.com (Spyware)"; content:"|0e|fuzugomaqeriwy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fygadajepi.com (Spyware)"; content:"|0a|fygadajepi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyqotarohoc.com (Spyware)"; content:"|0b|fyqotarohoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fysuhojyryhyj.com (Spyware)"; content:"|0d|fysuhojyryhyj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyxinolydima.com (Spyware)"; content:"|0c|fyxinolydima|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabtag.in (Botnet_C&C)"; content:"|06|gabtag|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galleryvine.com (Botnet_C&C)"; content:"|0b|galleryvine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gcdwmiqgbvf.com (Zeus_Zbot_SpyEye)"; content:"|0b|gcdwmiqgbvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigaster.in (Botnet_C&C)"; content:"|08|gigaster|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatfilesonline.com (Botnet_C&C)"; content:"|10|greatfilesonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grindbuzzchat.in (Botnet_C&C)"; content:"|0d|grindbuzzchat|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hand-band.ru (Malware_Distribution)"; content:"|09|hand-band|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heatherlycreations.com (Phishing_and_Theft)"; content:"|12|heatherlycreations|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiddl.com (Malware_Infectors)"; content:"|05|hiddl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibnopecut.hopto.org (Malware_Infectors)"; content:"|09|ibnopecut|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jlmvsurpnknvdhm.info (Zeus_Zbot_SpyEye)"; content:"|0f|jlmvsurpnknvdhm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpkpbxkoxwijzijr.info (Malware_Distribution)"; content:"|10|jpkpbxkoxwijzijr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jruioljslsitjpfv.biz (Malware_Distribution)"; content:"|10|jruioljslsitjpfv|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jskodjupryknitj.info (Zeus_Zbot_SpyEye)"; content:"|0f|jskodjupryknitj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klopster.in (Fake_AV)"; content:"|08|klopster|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lhfknpvnhqvhnio.info (Zeus_Zbot_SpyEye)"; content:"|0f|lhfknpvnhqvhnio|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lnpjlxislnspdrz.org (Zeus_Zbot_SpyEye)"; content:"|0f|lnpjlxislnspdrz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lopatanwey.hopto.org (Malware_Infectors)"; content:"|0a|lopatanwey|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lrorufugcvtzqor.com (Zeus_Zbot_SpyEye)"; content:"|0f|lrorufugcvtzqor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyuijfpqppkoyoq.net (Zeus_Zbot_SpyEye)"; content:"|0f|lyuijfpqppkoyoq|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwox.biz (Malware_Infectors)"; content:"|06|malwox|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup midbomb.ru (Zeus_Zbot_SpyEye)"; content:"|07|midbomb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mircturk.gen.tr (Malware_Infectors)"; content:"|08|mircturk|03|gen|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmqznasnmtlhvpng.com (Zeus_Zbot_SpyEye)"; content:"|10|mmqznasnmtlhvpng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moomles.in (Fake_AV)"; content:"|07|moomles|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muchachoslot.ru (Zeus_Zbot_SpyEye)"; content:"|0c|muchachoslot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup murkinduxck.uni.cc (Zeus_Zbot_SpyEye)"; content:"|0b|murkinduxck|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noordnabliocul.hopto.org (Malware_Infectors)"; content:"|0e|noordnabliocul|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ofgnrsiwpsuupstq.info (Zeus_Zbot_SpyEye)"; content:"|10|ofgnrsiwpsuupstq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olojkpcltulirqr.info (Malware_Distribution)"; content:"|0f|olojkpcltulirqr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ourtulip.ru (Zeus_Zbot_SpyEye)"; content:"|08|ourtulip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup owspgcipergcdipj.org (Zeus_Zbot_SpyEye)"; content:"|10|owspgcipergcdipj|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photopath.net (Botnet_C&C)"; content:"|09|photopath|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup picaminute.in (Botnet_C&C)"; content:"|0a|picaminute|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pixovuonline.in (Botnet_C&C)"; content:"|0c|pixovuonline|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pixovuonline.net (Botnet_C&C)"; content:"|0c|pixovuonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playerbox.net (Botnet_C&C)"; content:"|09|playerbox|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnolkppdqvknwzq.org (Zeus_Zbot_SpyEye)"; content:"|0f|pnolkppdqvknwzq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppopo2.bget.ru (Fake_AV)"; content:"|06|ppopo2|04|bget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup priestiset.net (Botnet_C&C)"; content:"|0a|priestiset|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privatepilot.hu (Fake_AV)"; content:"|0c|privatepilot|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prodatainc.net (Malware_Infectors)"; content:"|0a|prodatainc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proscan.co.kr (Malware_Infectors)"; content:"|07|proscan|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pyxovirginia.in (Botnet_C&C)"; content:"|0c|pyxovirginia|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qnsggfsmgnvilmsh.net (Zeus_Zbot_SpyEye)"; content:"|10|qnsggfsmgnvilmsh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup repbits.com (Phishing_and_Theft)"; content:"|07|repbits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup runescapegpge2011.ru (Malware_Distribution)"; content:"|11|runescapegpge2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salesian.net (Malware_Distribution)"; content:"|08|salesian|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup senerino.in (Fake_AV)"; content:"|08|senerino|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sihuirading.com (Malware_Infectors)"; content:"|0b|sihuirading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slljiwoncqesh.info (Zeus_Zbot_SpyEye)"; content:"|0d|slljiwoncqesh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snkxlzrpoqqwuwy.org (Zeus_Zbot_SpyEye)"; content:"|0f|snkxlzrpoqqwuwy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solodiyi.com (Zeus_Zbot_SpyEye)"; content:"|08|solodiyi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sossyonuigopd.com (Zeus_Zbot_SpyEye)"; content:"|0d|sossyonuigopd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spadapele.com (Malware_Infectors)"; content:"|09|spadapele|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spelleit.in (Fake_AV)"; content:"|08|spelleit|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup svernick.in (Fake_AV)"; content:"|08|svernick|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tax-security-irs.com (Malware_Infectors)"; content:"|10|tax-security-irs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tjjhmtjlziebo.net (Malware_Distribution)"; content:"|0d|tjjhmtjlziebo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tjpzjoglinzruep.org (Zeus_Zbot_SpyEye)"; content:"|0f|tjpzjoglinzruep|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tkovvmxnglteuts.info (Zeus_Zbot_SpyEye)"; content:"|0f|tkovvmxnglteuts|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficsurfer.net (Malware_Infectors)"; content:"|0d|trafficsurfer|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trotlebungalo.com (Zeus_Zbot_SpyEye)"; content:"|0d|trotlebungalo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trwqfhxf.bee.pl (Malware_Infectors)"; content:"|08|trwqfhxf|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyvinokun.com (Spyware)"; content:"|09|tyvinokun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ucisatanamiz.com (Spyware)"; content:"|0c|ucisatanamiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhfqds.com (Zeus_Zbot_SpyEye)"; content:"|06|uhfqds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uokpfvmnxfrqsqmp.info (Zeus_Zbot_SpyEye)"; content:"|10|uokpfvmnxfrqsqmp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utolycofyd.com (Spyware)"; content:"|0a|utolycofyd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uussc.com (Malware_Infectors)"; content:"|05|uussc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uvewyjemowe.com (Spyware)"; content:"|0b|uvewyjemowe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uvlmhpysrswtsps.org (Zeus_Zbot_SpyEye)"; content:"|0f|uvlmhpysrswtsps|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verdumnn.com (Zeus_Zbot_SpyEye)"; content:"|08|verdumnn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video.bywhy.com (Fake_AV)"; content:"|05|video|05|bywhy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vmnszmothuovvoll.info (Zeus_Zbot_SpyEye)"; content:"|10|vmnszmothuovvoll|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vx.org.ua (Malware_Infectors)"; content:"|02|vx|03|org|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waspeeds.in (Fake_AV)"; content:"|08|waspeeds|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watchfamilyguynow2011.ru (Malware_Distribution)"; content:"|15|watchfamilyguynow2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westfight.ru (Zeus_Zbot_SpyEye)"; content:"|09|westfight|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wlnzkqmohuhzqyra.info (Malware_Distribution)"; content:"|10|wlnzkqmohuhzqyra|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x-scan.in (Fake_AV)"; content:"|06|x-scan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xuywmrwzyjbmhhzk.org (Zeus_Zbot_SpyEye)"; content:"|10|xuywmrwzyjbmhhzk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yomwarayom2001.ru (Malware_Distribution)"; content:"|0e|yomwarayom2001|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourscan.in (Fake_AV)"; content:"|08|yourscan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup halifaxshelanu.com (Malware_Distribution)"; content:"|0e|halifaxshelanu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rncafe.com (Malware_Distribution)"; content:"|06|rncafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privacyme.co.kr (Spyware)"; content:"|09|privacyme|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup productionguy.com (Malware_Distribution)"; content:"|0d|productionguy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antituta.ru (Malware_Distribution)"; content:"|08|antituta|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jwdassociates.com (Malware_Distribution)"; content:"|0d|jwdassociates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pealton.com (Malware_Distribution)"; content:"|07|pealton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0df0fe51bd077976a3b3e9bda9579065.info (Malware_Distribution)"; content:"|20|0df0fe51bd077976a3b3e9bda9579065|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1see.ir (Malware_Distribution)"; content:"|04|1see|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010.tk (Malware_Distribution)"; content:"|04|2010|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2220.b.hostable.me (Zeus_Zbot_SpyEye)"; content:"|04|2220|01|b|08|hostable|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 24consultant-news.net (Malware_Distribution)"; content:"|11|24consultant-news|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 24job-consultant.net (Malware_Distribution)"; content:"|10|24job-consultant|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 24job-reporter.net (Malware_Distribution)"; content:"|0e|24job-reporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 24jobreporter.net (Malware_Distribution)"; content:"|0d|24jobreporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 265w.com (Malware_Infectors)"; content:"|04|265w|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 271fe7fe446d89c66bce464f8250abd2.info (Malware_Distribution)"; content:"|20|271fe7fe446d89c66bce464f8250abd2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 365-newspress.net (Malware_Distribution)"; content:"|0d|365-newspress|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 365news-week.net (Malware_Distribution)"; content:"|0c|365news-week|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 365newspress.net (Malware_Distribution)"; content:"|0c|365newspress|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 365newsweek.net (Malware_Distribution)"; content:"|0b|365newsweek|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 45th-durkar.org.uk (Malware_Infectors)"; content:"|0b|45th-durkar|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4iter.net.ru (Malware_Infectors)"; content:"|05|4iter|03|net|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4thalasses.gr (Malware_Infectors)"; content:"|0a|4thalasses|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7oorq8.com (Zeus_Zbot_SpyEye)"; content:"|06|7oorq8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alannahgunter.gen.nz (Malware_Distribution)"; content:"|0d|alannahgunter|03|gen|02|nz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americanbanker.org (Malware_Distribution)"; content:"|0e|americanbanker|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anamol.net (Malware_Distribution)"; content:"|06|anamol|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artiyono.com (Malware_Distribution)"; content:"|08|artiyono|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atnlftea220.xxxxxxxx.jp (Malware_Infectors)"; content:"|0b|atnlftea220|08|xxxxxxxx|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup audioleech.com (Malware_Distribution)"; content:"|0a|audioleech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autosloansonlines.com (Malware_Distribution)"; content:"|11|autosloansonlines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avlsystems.net (Malware_Infectors)"; content:"|0a|avlsystems|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avv-roermond.nl (Malware_Distribution)"; content:"|0c|avv-roermond|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b-k-ind.com (Malware_Infectors)"; content:"|07|b-k-ind|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bf2back.sinip.es (Zeus_Zbot_SpyEye)"; content:"|07|bf2back|05|sinip|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bfisback.no-ip.org (Zeus_Zbot_SpyEye)"; content:"|08|bfisback|05|no-ip|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackhatworld.com (Zeus_Zbot_SpyEye)"; content:"|0d|blackhatworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bupv19.needstub.com (Zeus_Zbot_SpyEye)"; content:"|06|bupv19|08|needstub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bytim.net (Malware_Distribution)"; content:"|05|bytim|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carboxxxs400.biz (Zeus_Zbot_SpyEye)"; content:"|0c|carboxxxs400|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carsfunranged.com (Zeus_Zbot_SpyEye)"; content:"|0d|carsfunranged|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheesydoodle.com (Malware_Infectors)"; content:"|0c|cheesydoodle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citybunchde.com (Malware_Distribution)"; content:"|0b|citybunchde|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cocainy.net (Zeus_Zbot_SpyEye)"; content:"|07|cocainy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comeadec.com.br (Malware_Distribution)"; content:"|08|comeadec|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpatank.com (Malware_Infectors)"; content:"|07|cpatank|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpucardioholder.com (Zeus_Zbot_SpyEye)"; content:"|0f|cpucardioholder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup craken.biz (Zeus_Zbot_SpyEye)"; content:"|06|craken|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crazeyt.com (Malware_Distribution)"; content:"|07|crazeyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cucineinmuraturapei.com (Malware_Infectors)"; content:"|13|cucineinmuraturapei|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dci.isgre.at (Malware_Distribution)"; content:"|03|dci|05|isgre|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dcusp.idolmovies.com (Zeus_Zbot_SpyEye)"; content:"|05|dcusp|0a|idolmovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup departamento.com.br (Malware_Infectors)"; content:"|0c|departamento|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup disk21.com (Malware_Infectors)"; content:"|06|disk21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dmr.tw (Malware_Distribution)"; content:"|03|dmr|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-123.cn (Malware_Distribution)"; content:"|0c|download-123|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-circle.co.cc (Malware_Distribution)"; content:"|0f|download-circle|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e7j0ht.cn (Zeus_Zbot_SpyEye)"; content:"|06|e7j0ht|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easymetin2.info (Malware_Infectors)"; content:"|0a|easymetin2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edymokowe.com (Spyware)"; content:"|09|edymokowe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egghelp-bg.com (Malware_Distribution)"; content:"|0a|egghelp-bg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup encybest.com (Malware_Distribution)"; content:"|08|encybest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evo-booter.net (Malware_Infectors)"; content:"|0a|evo-booter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extra-tube.net (Malware_Distribution)"; content:"|0a|extra-tube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fabtexbd.com (Malware_Distribution)"; content:"|08|fabtexbd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup figromanetwork.it (Malware_Distribution)"; content:"|0e|figromanetwork|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filletrouteeg.com (Zeus_Zbot_SpyEye)"; content:"|0d|filletrouteeg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filljobs.net (Malware_Distribution)"; content:"|08|filljobs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fitle8.com (SEO_Fraud)"; content:"|06|fitle8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-sex-video.biz (Malware_Distribution)"; content:"|0e|free-sex-video|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freefacebookhacking.com (Malware_Infectors)"; content:"|13|freefacebookhacking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frodosaife.co.cc (Malware_Distribution)"; content:"|0a|frodosaife|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamedak.com (Malware_Distribution)"; content:"|07|gamedak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gawupywibemohe.com (Spyware)"; content:"|0e|gawupywibemohe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gehafovykylyra.com (Spyware)"; content:"|0e|gehafovykylyra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gehilomygeqyme.com (Spyware)"; content:"|0e|gehilomygeqyme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup germanadvertising.net (Malware_Distribution)"; content:"|11|germanadvertising|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gibagexyz.com (Spyware)"; content:"|09|gibagexyz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gidehujosyp.com (Spyware)"; content:"|0b|gidehujosyp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gihuseqob.com (Spyware)"; content:"|09|gihuseqob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalpoweringgatheringon.com (Malware_Distribution)"; content:"|19|globalpoweringgatheringon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analitic.com (Malware_Distribution)"; content:"|0f|google-analitic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatsouthshore.com (Zeus_Zbot_SpyEye)"; content:"|0f|greatsouthshore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahahaha.ishtiben.com (Zeus_Zbot_SpyEye)"; content:"|08|hahahaha|08|ishtiben|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiddenglenarts.com (Botnet_C&C)"; content:"|0e|hiddenglenarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hipartsonline.com (Botnet_C&C)"; content:"|0d|hipartsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitmen.it (Zeus_Zbot_SpyEye)"; content:"|06|hitmen|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hlosportales.com (Malware_Distribution)"; content:"|0c|hlosportales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeartnet.com (Botnet_C&C)"; content:"|0a|homeartnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homebuyline.com (Botnet_C&C)"; content:"|0b|homebuyline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoodmice.com (Zeus_Zbot_SpyEye)"; content:"|08|hoodmice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosfamily.com (Botnet_C&C)"; content:"|09|hosfamily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostvark.co.uk (Malware_Infectors)"; content:"|08|hostvark|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotshows.org (Zeus_Zbot_SpyEye)"; content:"|08|hotshows|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotstaffshop.in (Botnet_C&C)"; content:"|0c|hotstaffshop|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotyoungart.com (Botnet_C&C)"; content:"|0b|hotyoungart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup housbard.com (Zeus_Zbot_SpyEye)"; content:"|08|housbard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hr-ramenendeuren.be (Malware_Distribution)"; content:"|10|hr-ramenendeuren|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hztian.com (Botnet_C&C)"; content:"|06|hztian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illegalness.com (Zeus_Zbot_SpyEye)"; content:"|0b|illegalness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilo.brenz.pl (Zeus_Zbot_SpyEye)"; content:"|03|ilo|05|brenz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imageshacks.net (Malware_Distribution)"; content:"|0b|imageshacks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img.doyo.cn (Malware_Infectors)"; content:"|03|img|04|doyo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup incas.co.kr (Malware_Distribution)"; content:"|05|incas|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ineturet.com (Spyware)"; content:"|08|ineturet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inningter.com (Botnet_C&C)"; content:"|09|inningter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inturpo.com (Malware_Distribution)"; content:"|07|inturpo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup investigatii-private.ro (Malware_Infectors)"; content:"|14|investigatii-private|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ircr0x.drshells.net (Zeus_Zbot_SpyEye)"; content:"|06|ircr0x|08|drshells|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irubireqakah.com (Spyware)"; content:"|0c|irubireqakah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ishtiben.com (Zeus_Zbot_SpyEye)"; content:"|08|ishtiben|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup istanbulcheaphotels.com (Malware_Distribution)"; content:"|13|istanbulcheaphotels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup italianbestarts.com (Botnet_C&C)"; content:"|0f|italianbestarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup izuhuhyq.com (Spyware)"; content:"|08|izuhuhyq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaduhylaw.com (Spyware)"; content:"|09|jaduhylaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jamesbsmith4th.biz (Malware_Distribution)"; content:"|0e|jamesbsmith4th|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javagames7.com (Zeus_Zbot_SpyEye)"; content:"|0a|javagames7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetblab.in (Botnet_C&C)"; content:"|07|jetblab|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetmember.net (Botnet_C&C)"; content:"|09|jetmember|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jimcardgames.com (Malware_Distribution)"; content:"|0c|jimcardgames|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup journaltag.net (Botnet_C&C)"; content:"|0a|journaltag|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpzpuvkpwjmytgz.info (Zeus_Zbot_SpyEye)"; content:"|0f|jpzpuvkpwjmytgz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup js-perso.ifrance.com (Malware_Distribution)"; content:"|08|js-perso|07|ifrance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jscriptix.ru (Malware_Distribution)"; content:"|09|jscriptix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jumpcast.in (Botnet_C&C)"; content:"|08|jumpcast|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jumplabel.net (Botnet_C&C)"; content:"|09|jumplabel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jusan.com (Malware_Infectors)"; content:"|05|jusan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justchatz.com (Zeus_Zbot_SpyEye)"; content:"|09|justchatz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jvhmhmjronmjd.info (Zeus_Zbot_SpyEye)"; content:"|0d|jvhmhmjronmjd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyron.com (Botnet_C&C)"; content:"|05|jyron|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karnatakaprisons.org (Malware_Distribution)"; content:"|10|karnatakaprisons|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kayblenewsmax.in (Botnet_C&C)"; content:"|0d|kayblenewsmax|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keep2.me (Malware_Infectors)"; content:"|05|keep2|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingfinearts.com (Botnet_C&C)"; content:"|0c|kingfinearts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kinix.in (Botnet_C&C)"; content:"|05|kinix|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kksd3.c0m.li (Malware_Distribution)"; content:"|05|kksd3|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kraus-systems.com (Malware_Distribution)"; content:"|0d|kraus-systems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krupreeda.com (Malware_Distribution)"; content:"|09|krupreeda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwilium.net (Botnet_C&C)"; content:"|07|kwilium|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwinte.in (Botnet_C&C)"; content:"|06|kwinte|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwiveeinc.net (Botnet_C&C)"; content:"|09|kwiveeinc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l2frota.hd1.com.br (Malware_Distribution)"; content:"|07|l2frota|03|hd1|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labelchips.net (Botnet_C&C)"; content:"|0a|labelchips|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lamathrinstexfa.co.cc (Malware_Distribution)"; content:"|0f|lamathrinstexfa|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lamplitr.com (Malware_Distribution)"; content:"|08|lamplitr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legionarios.servecounterstrike.com (Zeus_Zbot_SpyEye)"; content:"|0b|legionarios|12|servecounterstrike|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legovisualarts.com (Botnet_C&C)"; content:"|0e|legovisualarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup licke.net (Botnet_C&C)"; content:"|05|licke|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linaangel.biz (Zeus_Zbot_SpyEye)"; content:"|09|linaangel|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkshots.net (Botnet_C&C)"; content:"|09|linkshots|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linktechno.com (Malware_Distribution)"; content:"|0a|linktechno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveonair.net (Malware_Distribution)"; content:"|09|liveonair|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lwpjxnoztlwxyhd.org (Zeus_Zbot_SpyEye)"; content:"|0f|lwpjxnoztlwxyhd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maribit.com (Malware_Distribution)"; content:"|07|maribit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megapromotamfidelidade.tk (Phishing_and_Theft)"; content:"|16|megapromotamfidelidade|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meruma.sakura.ne.jp (Malware_Infectors)"; content:"|06|meruma|06|sakura|02|ne|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mintonette.nl (Malware_Infectors)"; content:"|0a|mintonette|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mixmaxgroup.cn (Malware_Distribution)"; content:"|0b|mixmaxgroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmnwokpspwpkpnkd.info (Zeus_Zbot_SpyEye)"; content:"|10|mmnwokpspwpkpnkd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup molo.tw (Malware_Distribution)"; content:"|04|molo|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mundoblog.net (Malware_Distribution)"; content:"|09|mundoblog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup murzhirata.info (Malware_Infectors)"; content:"|0a|murzhirata|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myccleaner.ru ()"; content:"|0a|myccleaner|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nayuuh.com (Zeus_Zbot_SpyEye)"; content:"|06|nayuuh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-serasa.info (Phishing_and_Theft)"; content:"|0a|net-serasa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicolaszuliani.com.ar (Malware_Distribution)"; content:"|0e|nicolaszuliani|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nomomlrjmysmmjos.com (Zeus_Zbot_SpyEye)"; content:"|10|nomomlrjmysmmjos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntkrnlpa.cn (Malware_Distribution)"; content:"|08|ntkrnlpa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyjowexawyr.com (Spyware)"; content:"|0b|nyjowexawyr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odessitov.net (Malware_Infectors)"; content:"|09|odessitov|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ofowywal.com (Spyware)"; content:"|08|ofowywal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogofocokow.com (Spyware)"; content:"|0a|ogofocokow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogotytaw.com (Spyware)"; content:"|08|ogotytaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohmiga.com (Malware_Infectors)"; content:"|06|ohmiga|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ontvplayer.com (Malware_Infectors)"; content:"|0a|ontvplayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otmqmkpyvcnnoi.com (Zeus_Zbot_SpyEye)"; content:"|0e|otmqmkpyvcnnoi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ovahukyq.com (Spyware)"; content:"|08|ovahukyq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ozelyavuzselim.k12.tr (Malware_Distribution)"; content:"|0e|ozelyavuzselim|03|k12|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pacugegyfeheka.com (Spyware)"; content:"|0e|pacugegyfeheka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalsyscheck.com (Malware_Distribution)"; content:"|10|personalsyscheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup picshic.com (Malware_Distribution)"; content:"|07|picshic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pijynazerud.com (Spyware)"; content:"|0b|pijynazerud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pleresttonin4u.com (Zeus_Zbot_SpyEye)"; content:"|0e|pleresttonin4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plotdut.ns13-wistee.fr (Malware_Infectors)"; content:"|07|plotdut|0b|ns13-wistee|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pojizocimovi.com (Spyware)"; content:"|0c|pojizocimovi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ponagifyna.com (Spyware)"; content:"|0a|ponagifyna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poquwaluj.com (Spyware)"; content:"|09|poquwaluj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornno.com (Malware_Distribution)"; content:"|06|pornno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premioscielo.com.br (Phishing_and_Theft)"; content:"|0c|premioscielo|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qobiragevuryt.com (Spyware)"; content:"|0d|qobiragevuryt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickhttp.com (Malware_Infectors)"; content:"|09|quickhttp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qupofajojuh.com (Spyware)"; content:"|0b|qupofajojuh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quvujykolenuja.com (Spyware)"; content:"|0e|quvujykolenuja|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quwecanocowi.com (Spyware)"; content:"|0c|quwecanocowi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quxebohadige.com (Spyware)"; content:"|0c|quxebohadige|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quxovasuced.com (Spyware)"; content:"|0b|quxovasuced|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qybolysusefim.com (Spyware)"; content:"|0d|qybolysusefim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qyvexyhun.com (Spyware)"; content:"|09|qyvexyhun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qyvyzesiro.com (Spyware)"; content:"|0a|qyvyzesiro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qyzywapoz.com (Spyware)"; content:"|09|qyzywapoz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r0218.rsstatic.ru (Malware_Distribution)"; content:"|05|r0218|08|rsstatic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ravewines.com (Malware_Infectors)"; content:"|09|ravewines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup renault.czechian.net (Malware_Distribution)"; content:"|07|renault|08|czechian|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rsoftware.net (Malware_Distribution)"; content:"|09|rsoftware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryzevepapucof.com (Spyware)"; content:"|0d|ryzevepapucof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samykacagatet.com (Spyware)"; content:"|0d|samykacagatet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savanypih.com (Spyware)"; content:"|09|savanypih|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sazulipum.com (Spyware)"; content:"|09|sazulipum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secredi.com (Phishing_and_Theft)"; content:"|07|secredi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seotrafficsuite.com (Malware_Infectors)"; content:"|0f|seotrafficsuite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ser-java.ucoz.ru (Malware_Infectors)"; content:"|08|ser-java|04|ucoz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sibnet.ru (Malware_Infectors)"; content:"|06|sibnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siimplesale.ru (Zeus_Zbot_SpyEye)"; content:"|0b|siimplesale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skypacifictravel.com (Malware_Distribution)"; content:"|10|skypacifictravel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slipla.com (Malware_Distribution)"; content:"|06|slipla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solidcdn.net (Malware_Infectors)"; content:"|08|solidcdn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soorajmull.net (Malware_Distribution)"; content:"|0a|soorajmull|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spiswitryn.com.pl (Malware_Distribution)"; content:"|0a|spiswitryn|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup studyingcenter-org.com (Zeus_Zbot_SpyEye)"; content:"|12|studyingcenter-org|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subtakean.go.th (Malware_Distribution)"; content:"|09|subtakean|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suintraf.com (Malware_Distribution)"; content:"|08|suintraf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup support.semptoshiba.com.br (Malware_Infectors)"; content:"|07|support|0b|semptoshiba|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabatti.com (Malware_Distribution)"; content:"|07|tabatti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup techtrendz.net (Malware_Distribution)"; content:"|0a|techtrendz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thekontak.ucoz.ru (Spyware)"; content:"|09|thekontak|04|ucoz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiasissi.com.br (Malware_Distribution)"; content:"|08|tiasissi|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todbot.info (Malware_Distribution)"; content:"|06|todbot|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transforserveur.fr.nf (Malware_Infectors)"; content:"|0f|transforserveur|02|fr|02|nf"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt88bon.biz (Zeus_Zbot_SpyEye)"; content:"|08|ttt88bon|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unionhire.net (Fake_AV)"; content:"|09|unionhire|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upcomd.com (Malware_Distribution)"; content:"|06|upcomd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vafuiek.com (Malware_Distribution)"; content:"|07|vafuiek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veryhotxxxporno.ru (Malware_Infectors)"; content:"|0f|veryhotxxxporno|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videorewardcentral.com (Malware_Distribution)"; content:"|12|videorewardcentral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vitaminmblog.com (Malware_Infectors)"; content:"|0c|vitaminmblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vm1huqpqf6e3g.com ()"; content:"|0d|vm1huqpqf6e3g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voltagechilla.com (Zeus_Zbot_SpyEye)"; content:"|0d|voltagechilla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wdjpq.net (Malware_Infectors)"; content:"|05|wdjpq|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webalta.ru (Zeus_Zbot_SpyEye)"; content:"|07|webalta|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weftnonwbvf.com (Malware_Infectors)"; content:"|0b|weftnonwbvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wieblatrino.hopto.org (Malware_Infectors)"; content:"|0b|wieblatrino|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wioltyskland.com (Malware_Infectors)"; content:"|0c|wioltyskland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiovtvolveras.com (Malware_Infectors)"; content:"|0d|wiovtvolveras|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrwcqzvhmjxsmzsv.net (Zeus_Zbot_SpyEye)"; content:"|10|wrwcqzvhmjxsmzsv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wtn.ac.th (Malware_Distribution)"; content:"|03|wtn|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wugcareer.com (Fake_AV)"; content:"|09|wugcareer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wugoffers.net (Fake_AV)"; content:"|09|wugoffers|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x-44.net (Malware_Infectors)"; content:"|04|x-44|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xbzobrgjprgzqe.biz (Zeus_Zbot_SpyEye)"; content:"|0e|xbzobrgjprgzqe|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhjwmyqxbvf.com (Malware_Infectors)"; content:"|0b|xhjwmyqxbvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xprezznet.com (Malware_Infectors)"; content:"|09|xprezznet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zavodnaya.at.ua (Malware_Distribution)"; content:"|09|zavodnaya|02|at|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifestyle.ie (Malware_Distribution)"; content:"|09|lifestyle|02|ie"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2plus2is6.cu.cc ()"; content:"|09|2plus2is6|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3rdistudio.com (Malware_Infectors)"; content:"|0a|3rdistudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actual-network.ru ()"; content:"|0e|actual-network|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actualconnection.ru ()"; content:"|10|actualconnection|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actualnetwork.ru ()"; content:"|0d|actualnetwork|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ai3mini.cu.cc ()"; content:"|07|ai3mini|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alhjran.eb2a.com (Malware_Distribution)"; content:"|07|alhjran|04|eb2a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alleyxdgws.uni.cc (Malware_Distribution)"; content:"|0a|alleyxdgws|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allocatwtb.uni.cc (Malware_Distribution)"; content:"|0a|allocatwtb|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allow-company.ru ()"; content:"|0d|allow-company|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allowcompany.ru ()"; content:"|0c|allowcompany|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allowupdate.ru ()"; content:"|0b|allowupdate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analgas.info (Malware_Distribution)"; content:"|07|analgas|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiserawtzy.uni.cc (Malware_Distribution)"; content:"|0c|antiserawtzy|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asesoriaempresarialcr.com (Malware_Distribution)"; content:"|15|asesoriaempresarialcr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ast-time.ru ()"; content:"|08|ast-time|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup audicamp.cu.cc ()"; content:"|08|audicamp|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baletour.at (Malware_Distribution)"; content:"|08|baletour|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-rbguard.rr.nu (Malware_Distribution)"; content:"|0c|best-rbguard|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestpisuite.rr.nu (Malware_Distribution)"; content:"|0b|bestpisuite|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bjork2.com (Malware_Distribution)"; content:"|06|bjork2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bodosvolvogarage.de (Malware_Distribution)"; content:"|10|bodosvolvogarage|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonus-discount.ru ()"; content:"|0e|bonus-discount|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boyarssubjugationy.info (Malware_Distribution)"; content:"|12|boyarssubjugationy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brandyexcludedy.info (Malware_Distribution)"; content:"|0f|brandyexcludedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bridaltotalt.info (Malware_Distribution)"; content:"|0c|bridaltotalt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup britishcourierservices.com (Phishing_and_Theft)"; content:"|16|britishcourierservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brotherdisobediencet.info (Malware_Distribution)"; content:"|14|brotherdisobediencet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bstunvzykqqpjo.com (Zeus_Zbot_SpyEye)"; content:"|0e|bstunvzykqqpjo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bttrrzf.co.cc (Malware_Distribution)"; content:"|07|bttrrzf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulwarktowl.info (Malware_Distribution)"; content:"|0b|bulwarktowl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burnedidolatryo.info (Malware_Distribution)"; content:"|0f|burnedidolatryo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burnedmaterialsl.info (Malware_Distribution)"; content:"|10|burnedmaterialsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buro47.ru (Malware_Distribution)"; content:"|06|buro47|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup business-daily7jobs.net (Malware_Distribution)"; content:"|13|business-daily7jobs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup business7days.net (Malware_Distribution)"; content:"|0d|business7days|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bxdumusallied.com (Malware_Infectors)"; content:"|0d|bxdumusallied|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byregentt.info (Malware_Distribution)"; content:"|09|byregentt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cacacacacacacacaca.ca (Malware_Distribution)"; content:"|12|cacacacacacacacaca|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cadelcucco.com (Malware_Distribution)"; content:"|0a|cadelcucco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camarilla-fr.com (Malware_Distribution)"; content:"|0c|camarilla-fr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup campaignreasoni.info (Malware_Distribution)"; content:"|0f|campaignreasoni|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup campunderstoods.info (Malware_Distribution)"; content:"|0f|campunderstoods|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup candlesprecinctsl.info (Malware_Distribution)"; content:"|11|candlesprecinctsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carvtech.cu.cc ()"; content:"|08|carvtech|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chpxchina.cu.cc ()"; content:"|09|chpxchina|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cicarredgtal.servecounterstrike.com (Malware_Distribution)"; content:"|0c|cicarredgtal|12|servecounterstrike|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cliqe.ru (Malware_Distribution)"; content:"|05|cliqe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clixtuga.cu.cc ()"; content:"|08|clixtuga|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colombiadeportiva.com (Malware_Distribution)"; content:"|11|colombiadeportiva|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup communityrendingt.info (Malware_Distribution)"; content:"|11|communityrendingt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup companyupdate.ru ()"; content:"|0d|companyupdate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compassionsuspendedt.info (Malware_Distribution)"; content:"|14|compassionsuspendedt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup composedfriendshipl.info (Malware_Distribution)"; content:"|13|composedfriendshipl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conceivesknownd.info (Malware_Distribution)"; content:"|0f|conceivesknownd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conceivespridei.info (Malware_Distribution)"; content:"|0f|conceivespridei|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conductedparolez.info (Malware_Distribution)"; content:"|10|conductedparolez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conetsco.org (Malware_Infectors)"; content:"|08|conetsco|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup confinedstupidityz.info (Malware_Distribution)"; content:"|12|confinedstupidityz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup confusedrealy.info (Malware_Distribution)"; content:"|0d|confusedrealy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conjunctiontrumpeterl.info (Malware_Distribution)"; content:"|15|conjunctiontrumpeterl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connectionfast.ru ()"; content:"|0e|connectionfast|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connectionreluctantlys.info (Malware_Distribution)"; content:"|16|connectionreluctantlys|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conquerequallyl.info (Malware_Distribution)"; content:"|0f|conquerequallyl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conqueringexcitementa.info (Malware_Distribution)"; content:"|15|conqueringexcitementa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conquernavigatingd.info (Malware_Distribution)"; content:"|12|conquernavigatingd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup consciencewents.info (Malware_Distribution)"; content:"|0f|consciencewents|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup considerableexecutiond.info (Malware_Distribution)"; content:"|16|considerableexecutiond|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup construticocr.com (Zeus_Zbot_SpyEye)"; content:"|0d|construticocr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coopagro.coop.br (Malware_Infectors)"; content:"|08|coopagro|04|coop|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daosf3doapo.com (Zeus_Zbot_SpyEye)"; content:"|0b|daosf3doapo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddc1000.com (Malware_Distribution)"; content:"|07|ddc1000|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddiziizlet.com (Malware_Distribution)"; content:"|0a|ddiziizlet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defyoli.info (Malware_Distribution)"; content:"|07|defyoli|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defyzx.info (Malware_Distribution)"; content:"|06|defyzx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djnasko.cu.cc ()"; content:"|07|djnasko|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dogbutic.com (Malware_Distribution)"; content:"|08|dogbutic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dqn6drj.ru (Malware_Distribution)"; content:"|07|dqn6drj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup droolamps.cu.cc ()"; content:"|09|droolamps|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dszrmttqpzlioqtp.biz (Zeus_Zbot_SpyEye)"; content:"|10|dszrmttqpzlioqtp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duel360.cu.cc ()"; content:"|07|duel360|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwzporn4.ru (Malware_Distribution)"; content:"|08|dwzporn4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eating-organic.net (Malware_Distribution)"; content:"|0e|eating-organic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emlakfinans.cu.cc ()"; content:"|0b|emlakfinans|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epaises.cu.cc ()"; content:"|07|epaises|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup espacioseguro.com (Malware_Distribution)"; content:"|0d|espacioseguro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exfile.ru (Malware_Distribution)"; content:"|06|exfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebookomarac.com (Malware_Distribution)"; content:"|0e|facebookomarac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-report-irs.com (Zeus_Zbot_SpyEye)"; content:"|0f|file-report-irs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files-irs-pdf.com (Malware_Distribution)"; content:"|0d|files-irs-pdf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filoilkogretim.com (Malware_Distribution)"; content:"|0e|filoilkogretim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flwrshop.biz (Zeus_Zbot_SpyEye)"; content:"|08|flwrshop|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup game-king-super.ru (Malware_Distribution)"; content:"|0f|game-king-super|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup game-super-king.ru (Malware_Distribution)"; content:"|0f|game-super-king|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamekingsuper.ru (Malware_Distribution)"; content:"|0d|gamekingsuper|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamesuperking.ru (Malware_Distribution)"; content:"|0d|gamesuperking|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdesfnmgbvf.com (Malware_Distribution)"; content:"|0b|gdesfnmgbvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generation-internet.ru ()"; content:"|13|generation-internet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generation-security.ru ()"; content:"|13|generation-security|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generationsecurity.ru ()"; content:"|12|generationsecurity|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-report-irs.com (Zeus_Zbot_SpyEye)"; content:"|0e|get-report-irs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ginafinkelsteinproductions.com (Malware_Distribution)"; content:"|1a|ginafinkelsteinproductions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup granbyfree.cu.cc ()"; content:"|0a|granbyfree|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greybrooks.cu.cc ()"; content:"|0a|greybrooks|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h78mojkllkghjkghfj.co.cc (Malware_Distribution)"; content:"|12|h78mojkllkghjkghfj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hbew-27hbsm.com (Malware_Distribution)"; content:"|0b|hbew-27hbsm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdyskevoieaf.com (Zeus_Zbot_SpyEye)"; content:"|0c|hdyskevoieaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holidayna.cu.cc ()"; content:"|09|holidayna|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homebusiness-7news.net (Malware_Distribution)"; content:"|12|homebusiness-7news|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homebusiness-news.net (Malware_Distribution)"; content:"|11|homebusiness-news|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeputtingi.info (Malware_Distribution)"; content:"|0c|homeputtingi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup honey-ok.ru (Malware_Distribution)"; content:"|08|honey-ok|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup honorsamed.info (Malware_Distribution)"; content:"|0a|honorsamed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopelessgettingl.info (Malware_Distribution)"; content:"|10|hopelessgettingl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopetransactedi.info (Malware_Distribution)"; content:"|0f|hopetransactedi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopingtribunals.info (Malware_Distribution)"; content:"|0f|hopingtribunals|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horridsplendidlys.info (Malware_Distribution)"; content:"|11|horridsplendidlys|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horsetreatiess.info (Malware_Distribution)"; content:"|0e|horsetreatiess|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosting120-flash.sytes.net (Malware_Distribution)"; content:"|10|hosting120-flash|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosting253-host.servepics.com (Malware_Distribution)"; content:"|0f|hosting253-host|09|servepics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotlytolledyz.info (Malware_Distribution)"; content:"|0d|hotlytolledyz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup housecrimeaz.info (Malware_Distribution)"; content:"|0c|housecrimeaz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howbeats.com (Zeus_Zbot_SpyEye)"; content:"|08|howbeats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup humanmakesy.info (Malware_Distribution)"; content:"|0b|humanmakesy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hutsportsmouthl.info (Malware_Distribution)"; content:"|0f|hutsportsmouthl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hymndoeso.info (Malware_Distribution)"; content:"|09|hymndoeso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ideaobstinacys.info (Malware_Distribution)"; content:"|0e|ideaobstinacys|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idolatrydwarfst.info (Malware_Distribution)"; content:"|0f|idolatrydwarfst|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijasmine.cn (Malware_Distribution)"; content:"|08|ijasmine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijogjpkdprqpsugn.biz (Zeus_Zbot_SpyEye)"; content:"|10|ijogjpkdprqpsugn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imbecilesustainy.info (Malware_Distribution)"; content:"|10|imbecilesustainy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imitationnonl.info (Malware_Distribution)"; content:"|0d|imitationnonl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup immediateutterlyt.info (Malware_Distribution)"; content:"|11|immediateutterlyt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup impairedrepresentd.info (Malware_Distribution)"; content:"|12|impairedrepresentd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup impairedtransportingd.info (Malware_Distribution)"; content:"|15|impairedtransportingd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indohome.net (Malware_Distribution)"; content:"|08|indohome|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup injruhjxmtccrut.biz (Zeus_Zbot_SpyEye)"; content:"|0f|injruhjxmtccrut|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-safeness.ru ()"; content:"|11|internet-safeness|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irishlttto.cu.cc ()"; content:"|0a|irishlttto|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irsnoticereport.com (Malware_Distribution)"; content:"|0f|irsnoticereport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itchyclock.ru (SEO_Fraud)"; content:"|0a|itchyclock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwsjygtnltmvdex.biz (Zeus_Zbot_SpyEye)"; content:"|0f|iwsjygtnltmvdex|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jesntjsrjmpxt.com (Zeus_Zbot_SpyEye)"; content:"|0d|jesntjsrjmpxt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jinjazz.in (Malware_Distribution)"; content:"|07|jinjazz|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjdlhnnvotjswcue.info (Zeus_Zbot_SpyEye)"; content:"|10|jjdlhnnvotjswcue|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jrkvid4.ru (Malware_Distribution)"; content:"|07|jrkvid4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsihtspwcjgtlr.org (Zeus_Zbot_SpyEye)"; content:"|0e|jsihtspwcjgtlr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup king-game-super.ru (Malware_Distribution)"; content:"|0f|king-game-super|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup king-super-game.ru (Malware_Distribution)"; content:"|0f|king-super-game|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kinggamesuper.ru (Malware_Distribution)"; content:"|0d|kinggamesuper|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingsupergame.ru (Malware_Distribution)"; content:"|0d|kingsupergame|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kkksvmrsyxfvj.biz (Zeus_Zbot_SpyEye)"; content:"|0d|kkksvmrsyxfvj|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klnjyrlprmmqzn.biz (Zeus_Zbot_SpyEye)"; content:"|0e|klnjyrlprmmqzn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knvnrvhqlihezsj.com (Zeus_Zbot_SpyEye)"; content:"|0f|knvnrvhqlihezsj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krufop.com (SEO_Fraud)"; content:"|06|krufop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadmoviesite.in (Malware_Distribution)"; content:"|0d|loadmoviesite|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lvlvfpqvvqpcvuys.info (Zeus_Zbot_SpyEye)"; content:"|10|lvlvfpqvvqpcvuys|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magicjoefuncenters.de (Malware_Distribution)"; content:"|12|magicjoefuncenters|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mbeydogan.com (Malware_Distribution)"; content:"|09|mbeydogan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mensiz.com (Malware_Distribution)"; content:"|06|mensiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup misshunting.cu.cc ()"; content:"|0b|misshunting|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnrpxtmkkwmiliq.biz (Zeus_Zbot_SpyEye)"; content:"|0f|mnrpxtmkkwmiliq|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnxpeejxpvwrhkrm.biz (Zeus_Zbot_SpyEye)"; content:"|10|mnxpeejxpvwrhkrm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfotolog03.com (Malware_Distribution)"; content:"|0b|myfotolog03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myskymba.in (Botnet_C&C)"; content:"|08|myskymba|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naajlepsze.pl (Malware_Distribution)"; content:"|0a|naajlepsze|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nboxonline.in (Botnet_C&C)"; content:"|0a|nboxonline|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newtopbug.in (Botnet_C&C)"; content:"|09|newtopbug|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicepslink.rr.nu (Malware_Distribution)"; content:"|0a|nicepslink|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nlwelar5.ru (Malware_Distribution)"; content:"|08|nlwelar5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nocomcom.com (Malware_Distribution)"; content:"|08|nocomcom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nodiginternational.in (Botnet_C&C)"; content:"|12|nodiginternational|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nopao.com (Malware_Distribution)"; content:"|05|nopao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyhyjiletyhuq.ns0.it (Malware_Distribution)"; content:"|0d|nyhyjiletyhuq|03|ns0|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogameing.cu.cc ()"; content:"|08|ogameing|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opendatfiles.in (Botnet_C&C)"; content:"|0c|opendatfiles|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opnnopinvhs.com (Zeus_Zbot_SpyEye)"; content:"|0b|opnnopinvhs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oujjmusallied.com (Malware_Infectors)"; content:"|0d|oujjmusallied|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outrosolhos.cx.cc ()"; content:"|0b|outrosolhos|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ovsdllsnzkmrowqq.biz (Zeus_Zbot_SpyEye)"; content:"|10|ovsdllsnzkmrowqq|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ozrollfjqkrjhtor.org (Zeus_Zbot_SpyEye)"; content:"|10|ozrollfjqkrjhtor|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ozzcentral.com (Botnet_C&C)"; content:"|0a|ozzcentral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjtlsmnfjsypogrt.net (Zeus_Zbot_SpyEye)"; content:"|10|pjtlsmnfjsypogrt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planetsex.hdfree.in (Malware_Infectors)"; content:"|09|planetsex|06|hdfree|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pmuseum.ru (Malware_Distribution)"; content:"|07|pmuseum|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnltknsxsswzkku.net (Zeus_Zbot_SpyEye)"; content:"|0f|pnltknsxsswzkku|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnmtwnhxkgypk.info (Zeus_Zbot_SpyEye)"; content:"|0d|pnmtwnhxkgypk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pntvpmnpjggkmw.biz (Zeus_Zbot_SpyEye)"; content:"|0e|pntvpmnpjggkmw|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup power-programm.ru ()"; content:"|0e|power-programm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerprogramm.ru ()"; content:"|0d|powerprogramm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pozpwukkuoyhwrnm.org (Zeus_Zbot_SpyEye)"; content:"|10|pozpwukkuoyhwrnm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup programm-power.ru ()"; content:"|0e|programm-power|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup programmengineering.ru ()"; content:"|13|programmengineering|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup programmpower.ru ()"; content:"|0d|programmpower|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup progresoetico.com (Malware_Distribution)"; content:"|0d|progresoetico|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prontacard.cu.cc ()"; content:"|0a|prontacard|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pruszcz.medrod.pl (Phishing_and_Theft)"; content:"|07|pruszcz|06|medrod|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pvxjykswenfowdqh.info (Zeus_Zbot_SpyEye)"; content:"|10|pvxjykswenfowdqh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pyrconsultores.com (Malware_Infectors)"; content:"|0e|pyrconsultores|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qetvlnivjxwiqj.org (Zeus_Zbot_SpyEye)"; content:"|0e|qetvlnivjxwiqj|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qhrsvtqwjcmonpfp.biz (Zeus_Zbot_SpyEye)"; content:"|10|qhrsvtqwjcmonpfp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjzmiwsxdbwsqrqz.info (Zeus_Zbot_SpyEye)"; content:"|10|qjzmiwsxdbwsqrqz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qpbspgxoujpwiwuc.com (Zeus_Zbot_SpyEye)"; content:"|10|qpbspgxoujpwiwuc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualattice.in (Botnet_C&C)"; content:"|0a|qualattice|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quqnxnqeqtohjcso.org (Zeus_Zbot_SpyEye)"; content:"|10|quqnxnqeqtohjcso|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup residenciasantiago.com (Malware_Infectors)"; content:"|12|residenciasantiago|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riniririni.info (Malware_Distribution)"; content:"|0a|riniririni|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjdanesi.cu.cc ()"; content:"|08|rjdanesi|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roofgonebad.cu.cc ()"; content:"|0b|roofgonebad|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruvocana.comyr.com (Zeus_Zbot_SpyEye)"; content:"|08|ruvocana|05|comyr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rwvnmgmsrzgrvoh.info (Zeus_Zbot_SpyEye)"; content:"|0f|rwvnmgmsrzgrvoh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safearmyrw.rr.nu (Malware_Distribution)"; content:"|0a|safearmyrw|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savecsfsecurity.rr.nu (Malware_Distribution)"; content:"|0f|savecsfsecurity|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbcbtsusbvf.com (Malware_Distribution)"; content:"|0b|sbcbtsusbvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitygeneration.ru ()"; content:"|12|securitygeneration|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sekaisasl.cu.cc ()"; content:"|09|sekaisasl|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shanwang.cu.cc ()"; content:"|08|shanwang|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skypeel.cu.cc ()"; content:"|07|skypeel|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sncjspnrvxsxcz.com (Zeus_Zbot_SpyEye)"; content:"|0e|sncjspnrvxsxcz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spiswitryn.biz.pl (Malware_Distribution)"; content:"|0a|spiswitryn|03|biz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssjgkktjugwgepz.info (Zeus_Zbot_SpyEye)"; content:"|0f|ssjgkktjugwgepz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssmotlqsntvmop.com (Zeus_Zbot_SpyEye)"; content:"|0e|ssmotlqsntvmop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stowiwxmemkn.net (Zeus_Zbot_SpyEye)"; content:"|0c|stowiwxmemkn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sugybycunamehy.ns0.it (Malware_Distribution)"; content:"|0e|sugybycunamehy|03|ns0|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suierovkqoxrzmmb.info (Zeus_Zbot_SpyEye)"; content:"|10|suierovkqoxrzmmb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup summerbonus.ru ()"; content:"|0b|summerbonus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-game-king.ru (Malware_Distribution)"; content:"|0f|super-game-king|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-king-game.ru (Malware_Distribution)"; content:"|0f|super-king-game|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supergameking.ru (Malware_Distribution)"; content:"|0d|supergameking|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superkinggame.ru (Malware_Distribution)"; content:"|0d|superkinggame|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supertable.net (Botnet_C&C)"; content:"|0a|supertable|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swiftdeliveryservices.org (Phishing_and_Theft)"; content:"|15|swiftdeliveryservices|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-reports.com (Malware_Distribution)"; content:"|0e|system-reports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup takethatnet.cu.cc ()"; content:"|0b|takethatnet|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taptapping.cu.cc ()"; content:"|0a|taptapping|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxhe.in (Malware_Distribution)"; content:"|05|taxhe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestzyguard.rr.nu (Malware_Distribution)"; content:"|0e|thebestzyguard|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tierfreundliche-motels.de (Malware_Distribution)"; content:"|16|tierfreundliche-motels|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timeconnection.ru ()"; content:"|0e|timeconnection|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tlurionwxgynem.net (Zeus_Zbot_SpyEye)"; content:"|0e|tlurionwxgynem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toplake.ru (SEO_Fraud)"; content:"|07|toplake|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tpstneuknash.com (Malware_Infectors)"; content:"|0c|tpstneuknash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradeport24.com (Zeus_Zbot_SpyEye)"; content:"|0b|tradeport24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traduccionescr.com (Malware_Distribution)"; content:"|0e|traduccionescr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustors.cu.cc ()"; content:"|08|trustors|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truwofhvwslmsiv.com (Zeus_Zbot_SpyEye)"; content:"|0f|truwofhvwslmsiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt7.in (Malware_Distribution)"; content:"|03|tt7|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2652999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube253-hosting.servepics.com (Malware_Distribution)"; content:"|0f|tube253-hosting|09|servepics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tydklsbjfujklvjhksjhfj.co.cc (Zeus_Zbot_SpyEye)"; content:"|16|tydklsbjfujklvjhksjhfj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ufiwhqrjjtsdwjn.biz (Zeus_Zbot_SpyEye)"; content:"|0f|ufiwhqrjjtsdwjn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uk.sibnl.com (Fake_AV)"; content:"|02|uk|05|sibnl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultrainvisible.com (Zeus_Zbot_SpyEye)"; content:"|0e|ultrainvisible|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup umpysqgerrkstgo.biz (Zeus_Zbot_SpyEye)"; content:"|0f|umpysqgerrkstgo|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup untogovernmentsd.info (Malware_Distribution)"; content:"|10|untogovernmentsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unworthyavailedy.info (Malware_Distribution)"; content:"|10|unworthyavailedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upd-host.net (Zeus_Zbot_SpyEye)"; content:"|08|upd-host|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upstayd.info (Malware_Distribution)"; content:"|07|upstayd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urgingintimatedi.info (Malware_Distribution)"; content:"|10|urgingintimatedi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usa-shipping.com (Phishing_and_Theft)"; content:"|0c|usa-shipping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usemovementt.info (Malware_Distribution)"; content:"|0c|usemovementt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usf57.com (Malware_Distribution)"; content:"|05|usf57|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uthzscsrsouqlue.com (Zeus_Zbot_SpyEye)"; content:"|0f|uthzscsrsouqlue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utqworfhrkxmcqm.biz (Zeus_Zbot_SpyEye)"; content:"|0f|utqworfhrkxmcqm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uvelichcheln.ru (Malware_Distribution)"; content:"|0c|uvelichcheln|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uznloepzpertqrs.info (Zeus_Zbot_SpyEye)"; content:"|0f|uznloepzpertqrs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valorsociale.info (Malware_Distribution)"; content:"|0c|valorsociale|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vassalssleighsl.info (Malware_Distribution)"; content:"|0f|vassalssleighsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veniceadvisez.info (Malware_Distribution)"; content:"|0d|veniceadvisez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veronikapornosex.ru (Malware_Distribution)"; content:"|10|veronikapornosex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vertilineopa.net (Zeus_Zbot_SpyEye)"; content:"|0c|vertilineopa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vewiews.com (Zeus_Zbot_SpyEye)"; content:"|07|vewiews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vhvrprvwtlpzduy.biz (Zeus_Zbot_SpyEye)"; content:"|0f|vhvrprvwtlpzduy|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viewinstructingd.info (Malware_Distribution)"; content:"|10|viewinstructingd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visiongraficaperu.com (Malware_Distribution)"; content:"|11|visiongraficaperu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visitorcounter.net.in (Zeus_Zbot_SpyEye)"; content:"|0e|visitorcounter|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voluntaryappointeda.info (Malware_Distribution)"; content:"|13|voluntaryappointeda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vquolvppssixwgy.info (Zeus_Zbot_SpyEye)"; content:"|0f|vquolvppssixwgy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vqwpfyeyyxjhxgri.com (Zeus_Zbot_SpyEye)"; content:"|10|vqwpfyeyyxjhxgri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrgoryutlqnjpod.com (Zeus_Zbot_SpyEye)"; content:"|0f|vrgoryutlqnjpod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrjqehsppcgprhs.biz (Zeus_Zbot_SpyEye)"; content:"|0f|vrjqehsppcgprhs|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vslqkrsprvrqtqu.biz (Zeus_Zbot_SpyEye)"; content:"|0f|vslqkrsprvrqtqu|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vtfkp.net (Zeus_Zbot_SpyEye)"; content:"|05|vtfkp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vttyntejoqftwkcn.biz (Zeus_Zbot_SpyEye)"; content:"|10|vttyntejoqftwkcn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vyrus.redirectme.net (Zeus_Zbot_SpyEye)"; content:"|05|vyrus|0a|redirectme|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup walkedproportionated.info (Malware_Distribution)"; content:"|14|walkedproportionated|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wantadvertisey.info (Malware_Distribution)"; content:"|0e|wantadvertisey|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warlikeoccupyingo.info (Malware_Distribution)"; content:"|11|warlikeoccupyingo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waylaidquitl.info (Malware_Distribution)"; content:"|0c|waylaidquitl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wcpftp.com (Zeus_Zbot_SpyEye)"; content:"|06|wcpftp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weaponsfriendshipy.info (Malware_Distribution)"; content:"|12|weaponsfriendshipy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webapp.datejebemupicku.com (Zeus_Zbot_SpyEye)"; content:"|06|webapp|0f|datejebemupicku|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup week7news.net (Malware_Distribution)"; content:"|09|week7news|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whitepix.info (Malware_Distribution)"; content:"|08|whitepix|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wilsondacunha.com.br (Phishing_and_Theft)"; content:"|0d|wilsondacunha|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wjcam.net (Malware_Distribution)"; content:"|05|wjcam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wkrrxkbkfonsi.biz (Zeus_Zbot_SpyEye)"; content:"|0d|wkrrxkbkfonsi|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpjaltosmuttk.org (Zeus_Zbot_SpyEye)"; content:"|0d|wpjaltosmuttk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrssrjqpiyfsmwp.info (Zeus_Zbot_SpyEye)"; content:"|0f|wrssrjqpiyfsmwp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wtkrfpmgvssthymh.com (Zeus_Zbot_SpyEye)"; content:"|10|wtkrfpmgvssthymh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x188188x.su (Zeus_Zbot_SpyEye)"; content:"|08|x188188x|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xiftkqniniwoirvu.biz (Zeus_Zbot_SpyEye)"; content:"|10|xiftkqniniwoirvu|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xqdnmjnrvdjwgf.com (Zeus_Zbot_SpyEye)"; content:"|0e|xqdnmjnrvdjwgf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xqqpqjrzjynovt.com (Zeus_Zbot_SpyEye)"; content:"|0e|xqqpqjrzjynovt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxvtrrmbuqshu.biz (Zeus_Zbot_SpyEye)"; content:"|0d|xxvtrrmbuqshu|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxvwinjqarjrnw.com (Zeus_Zbot_SpyEye)"; content:"|0e|xxvwinjqarjrnw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ynnssrpdcuqmlrer.info (Zeus_Zbot_SpyEye)"; content:"|10|ynnssrpdcuqmlrer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yqfjkylgtuxpklv.com (Zeus_Zbot_SpyEye)"; content:"|0f|yqfjkylgtuxpklv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ysafyqaoipip.homepc.it (Malware_Distribution)"; content:"|0c|ysafyqaoipip|06|homepc|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ywilkswylnvufje.net (Zeus_Zbot_SpyEye)"; content:"|0f|ywilkswylnvufje|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yxnmnowlnwippxdq.info (Zeus_Zbot_SpyEye)"; content:"|10|yxnmnowlnwippxdq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zkqswlsghqiqqsyz.biz (Zeus_Zbot_SpyEye)"; content:"|10|zkqswlsghqiqqsyz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup znmoulhgfullqk.biz (Zeus_Zbot_SpyEye)"; content:"|0e|znmoulhgfullqk|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup znyrxxwropovt.info (Zeus_Zbot_SpyEye)"; content:"|0d|znyrxxwropovt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoflnpyvpknxolkp.org (Zeus_Zbot_SpyEye)"; content:"|10|zoflnpyvpknxolkp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zrpfmqyvqmxmhxfk.biz (Zeus_Zbot_SpyEye)"; content:"|10|zrpfmqyvqmxmhxfk|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsoqjlsznnussh.info (Zeus_Zbot_SpyEye)"; content:"|0e|zsoqjlsznnussh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zuvqpugmmmqrdskd.com (Zeus_Zbot_SpyEye)"; content:"|10|zuvqpugmmmqrdskd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zvktvbjvonnognp.com (Zeus_Zbot_SpyEye)"; content:"|0f|zvktvbjvonnognp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zxmknqcqzjupueux.biz (Zeus_Zbot_SpyEye)"; content:"|10|zxmknqcqzjupueux|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thpkmlnuzc.ru (Malware_Distribution)"; content:"|0a|thpkmlnuzc|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7reports-dailynews.net (Malware_Distribution)"; content:"|12|7reports-dailynews|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 81ff57dca2bfe7eba0906732a2c4ee41.info (Malware_Distribution)"; content:"|20|81ff57dca2bfe7eba0906732a2c4ee41|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abandonwaxt.info (Malware_Distribution)"; content:"|0b|abandonwaxt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ableunceasingl.info (Malware_Distribution)"; content:"|0e|ableunceasingl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abodeimpregnables.info (Malware_Distribution)"; content:"|11|abodeimpregnables|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abodevaluableso.info (Malware_Distribution)"; content:"|0f|abodevaluableso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abscondingsettlementd.info (Malware_Distribution)"; content:"|15|abscondingsettlementd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accededconquerorsy.info (Malware_Distribution)"; content:"|12|accededconquerorsy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acceptjewishy.info (Malware_Distribution)"; content:"|0d|acceptjewishy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alattemoney.cx.cc ()"; content:"|0b|alattemoney|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appdlsecure.com (Malware_Distribution)"; content:"|0b|appdlsecure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apscares.cx.cc ()"; content:"|08|apscares|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assmette.in (Malware_Distribution)"; content:"|08|assmette|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bkokfinthgsk.com (Malware_Infectors)"; content:"|0c|bkokfinthgsk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brooksupply.cx.cc ()"; content:"|0b|brooksupply|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cannonadingcharginga.info (Malware_Distribution)"; content:"|14|cannonadingcharginga|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capitalbribedl.info (Malware_Distribution)"; content:"|0e|capitalbribedl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup captiveawaitedy.info (Malware_Distribution)"; content:"|0f|captiveawaitedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup captiveheels.info (Malware_Distribution)"; content:"|0c|captiveheels|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carabinier.cx.cc ()"; content:"|0a|carabinier|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cargorepliedy.info (Malware_Distribution)"; content:"|0d|cargorepliedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carousingdesiresy.info (Malware_Distribution)"; content:"|11|carousingdesiresy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carpentrypatriaalattemoney.cx.cc ()"; content:"|1a|carpentrypatriaalattemoney|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carpentrypatriarchsl.info (Malware_Distribution)"; content:"|14|carpentrypatriarchsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carpentryunderstoodl.info (Malware_Distribution)"; content:"|14|carpentryunderstoodl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carpetedmournedd.info (Malware_Distribution)"; content:"|10|carpetedmournedd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carriagehearinga.info (Malware_Distribution)"; content:"|10|carriagehearinga|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catharineinvolvedo.info (Malware_Distribution)"; content:"|12|catharineinvolvedo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catharineremittancel.info (Malware_Distribution)"; content:"|14|catharineremittancel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup causingarguedo.info (Malware_Distribution)"; content:"|0e|causingarguedo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cctv576.co.com.au ()"; content:"|07|cctv576|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebratedisentanglel.info (Malware_Distribution)"; content:"|15|celebratedisentanglel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebratedmano.info (Malware_Distribution)"; content:"|0e|celebratedmano|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebratedsequeld.info (Malware_Distribution)"; content:"|11|celebratedsequeld|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centralretreatingl.info (Malware_Distribution)"; content:"|12|centralretreatingl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centresstoresa.info (Malware_Distribution)"; content:"|0e|centresstoresa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chambercommandi.info (Malware_Distribution)"; content:"|0f|chambercommandi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chamberlainperishings.info (Malware_Distribution)"; content:"|15|chamberlainperishings|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chandelierschoosesi.info (Malware_Distribution)"; content:"|13|chandelierschoosesi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chandeliersexcellenti.info (Malware_Distribution)"; content:"|15|chandeliersexcellenti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup changecitiesy.info (Malware_Distribution)"; content:"|0d|changecitiesy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chaptersilvera.info (Malware_Distribution)"; content:"|0e|chaptersilvera|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup characteristicjudged.info (Malware_Distribution)"; content:"|14|characteristicjudged|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chargingtiresomeo.info (Malware_Distribution)"; content:"|11|chargingtiresomeo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chiefremainso.info (Malware_Distribution)"; content:"|0d|chiefremainso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chieftainadmiralss.info (Malware_Distribution)"; content:"|12|chieftainadmiralss|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup choosepenaltiesa.info (Malware_Distribution)"; content:"|10|choosepenaltiesa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup churchcakeso.info (Malware_Distribution)"; content:"|0c|churchcakeso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup circuitousdurableo.info (Malware_Distribution)"; content:"|12|circuitousdurableo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup circumventsufferersy.info (Malware_Distribution)"; content:"|14|circumventsufferersy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citizendeliverso.info (Malware_Distribution)"; content:"|10|citizendeliverso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup claimeddeliberateo.info (Malware_Distribution)"; content:"|12|claimeddeliberateo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearlypleasel.info (Malware_Distribution)"; content:"|0e|clearlypleasel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clemencyefficientlyl.info (Malware_Distribution)"; content:"|14|clemencyefficientlyl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clergyundertakeny.info (Malware_Distribution)"; content:"|11|clergyundertakeny|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup climaxlinks.co.com.au ()"; content:"|0b|climaxlinks|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clolled.com (Malware_Distribution)"; content:"|07|clolled|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup closelypassionsi.info (Malware_Distribution)"; content:"|10|closelypassionsi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup closetsfightsl.info (Malware_Distribution)"; content:"|0e|closetsfightsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coarsestyled.info (Malware_Distribution)"; content:"|0c|coarsestyled|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coasterminet.info (Malware_Distribution)"; content:"|0c|coasterminet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collectabolishedy.info (Malware_Distribution)"; content:"|11|collectabolishedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collectbishopss.info (Malware_Distribution)"; content:"|0f|collectbishopss|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collectingquiety.info (Malware_Distribution)"; content:"|10|collectingquiety|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coloniesconstitutedd.info (Malware_Distribution)"; content:"|14|coloniesconstitutedd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup columninterruptiond.info (Malware_Distribution)"; content:"|13|columninterruptiond|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combinedfavorablei.info (Malware_Distribution)"; content:"|12|combinedfavorablei|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comecorruptingo.info (Malware_Distribution)"; content:"|0f|comecorruptingo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comfortablefatiguesa.info (Malware_Distribution)"; content:"|14|comfortablefatiguesa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup commandedangryi.info (Malware_Distribution)"; content:"|0f|commandedangryi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup commissionerpoetryz.info (Malware_Distribution)"; content:"|13|commissionerpoetryz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup commissionersopiniono.info (Malware_Distribution)"; content:"|15|commissionersopiniono|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup commissionfrightsy.info (Malware_Distribution)"; content:"|12|commissionfrightsy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup commitlay.info (Malware_Distribution)"; content:"|09|commitlay|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cossacksdeald.info (Malware_Distribution)"; content:"|0d|cossacksdeald|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cottageamongd.info (Malware_Distribution)"; content:"|0d|cottageamongd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup councilorsstupidlyl.info (Malware_Distribution)"; content:"|13|councilorsstupidlyl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countenancegrowsd.info (Malware_Distribution)"; content:"|11|countenancegrowsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup courageentertainingi.info (Malware_Distribution)"; content:"|14|courageentertainingi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup couvanskymoscowt.info (Malware_Distribution)"; content:"|10|couvanskymoscowt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cqoqgzqmkpkrmlo.com (Zeus_Zbot_SpyEye)"; content:"|0f|cqoqgzqmkpkrmlo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup createdsupplyo.info (Malware_Distribution)"; content:"|0e|createdsupplyo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crediteuropel.info (Malware_Distribution)"; content:"|0d|crediteuropel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup croixclaimeda.info (Malware_Distribution)"; content:"|0d|croixclaimeda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cursecrimeat.info (Malware_Distribution)"; content:"|0c|cursecrimeat|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curtailgovernedy.info (Malware_Distribution)"; content:"|10|curtailgovernedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup custodianmaturedt.info (Malware_Distribution)"; content:"|11|custodianmaturedt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup customrequiemsd.info (Malware_Distribution)"; content:"|0f|customrequiemsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup czarewitzjealousi.info (Malware_Distribution)"; content:"|11|czarewitzjealousi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup czarsgrimi.info (Malware_Distribution)"; content:"|0a|czarsgrimi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily-job-news.net (Malware_Distribution)"; content:"|0e|daily-job-news|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily-job-news7.net (Malware_Distribution)"; content:"|0f|daily-job-news7|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily-job-reporter.net (Malware_Distribution)"; content:"|12|daily-job-reporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily-jobpress.net (Malware_Distribution)"; content:"|0e|daily-jobpress|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily7.org (Malware_Distribution)"; content:"|06|daily7|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily7press.net (Malware_Distribution)"; content:"|0b|daily7press|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dantzicitd.info (Malware_Distribution)"; content:"|0a|dantzicitd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darewaxi.info (Malware_Distribution)"; content:"|08|darewaxi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darknesslacedy.info (Malware_Distribution)"; content:"|0e|darknesslacedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darknesspaintingsi.info (Malware_Distribution)"; content:"|12|darknesspaintingsi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbnkonline.com (Fake_AV)"; content:"|0a|dbnkonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dmmnskknmglirnte.org (Zeus_Zbot_SpyEye)"; content:"|10|dmmnskknmglirnte|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dutgjnpvgoqqmi.net (Zeus_Zbot_SpyEye)"; content:"|0e|dutgjnpvgoqqmi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-londonjobs.com (SEO_Fraud)"; content:"|0c|e-londonjobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecobnkltdonline.com (Fake_AV)"; content:"|0f|ecobnkltdonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecoonlinegh.com (Phishing_and_Theft)"; content:"|0b|ecoonlinegh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edinformer.com ()"; content:"|0a|edinformer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eijqgpqqsuht.org (Zeus_Zbot_SpyEye)"; content:"|0c|eijqgpqqsuht|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ergotables.com (Malware_Infectors)"; content:"|0a|ergotables|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estronta.hdfree.in (Malware_Infectors)"; content:"|08|estronta|06|hdfree|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup europasafe.com (Phishing_and_Theft)"; content:"|0a|europasafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euzzpjntlskotws.info (Zeus_Zbot_SpyEye)"; content:"|0f|euzzpjntlskotws|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fpowmtyzqsdsfxl.net (Zeus_Zbot_SpyEye)"; content:"|0f|fpowmtyzqsdsfxl|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fundsufficient.com ()"; content:"|0e|fundsufficient|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gfr24.com (Malware_Distribution)"; content:"|05|gfr24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gikmpljumkzbxnsj.net (Zeus_Zbot_SpyEye)"; content:"|10|gikmpljumkzbxnsj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girosorocaba.com.br (Malware_Infectors)"; content:"|0c|girosorocaba|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go2000.cn (Malware_Distribution)"; content:"|06|go2000|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gobeey.com (Malware_Infectors)"; content:"|06|gobeey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gphtznwlcqgq.org (Zeus_Zbot_SpyEye)"; content:"|0c|gphtznwlcqgq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtxwqptngkltozv.org (Zeus_Zbot_SpyEye)"; content:"|0f|gtxwqptngkltozv|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gywsglihvdleyupu.biz (Zeus_Zbot_SpyEye)"; content:"|10|gywsglihvdleyupu|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hevnlfxvqfrykk.info (Zeus_Zbot_SpyEye)"; content:"|0e|hevnlfxvqfrykk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostcostarica.net (Malware_Infectors)"; content:"|0d|hostcostarica|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hrbsanda.cx.cc ()"; content:"|08|hrbsanda|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hrxqnkovlvssuiv.org (Zeus_Zbot_SpyEye)"; content:"|0f|hrxqnkovlvssuiv|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hvlqmwtesqdkktgo.net (Zeus_Zbot_SpyEye)"; content:"|10|hvlqmwtesqdkktgo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icb-ukonline.com (Fake_AV)"; content:"|0c|icb-ukonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ingeocr.com (Malware_Distribution)"; content:"|07|ingeocr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itkwvfquvznhtpi.info (Zeus_Zbot_SpyEye)"; content:"|0f|itkwvfquvznhtpi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jghlygfjbvf.com (Malware_Infectors)"; content:"|0b|jghlygfjbvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jmjjeqfunuotrion.org (Zeus_Zbot_SpyEye)"; content:"|10|jmjjeqfunuotrion|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joseegm.cx.cc ()"; content:"|07|joseegm|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jylemufisanu.com (Spyware)"; content:"|0c|jylemufisanu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kagayakitai.com (Malware_Infectors)"; content:"|0b|kagayakitai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kitfree.hdfree.in (Malware_Infectors)"; content:"|07|kitfree|06|hdfree|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjrub.com (Zeus_Zbot_SpyEye)"; content:"|05|kjrub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kygalu.ru (Zeus_Zbot_SpyEye)"; content:"|06|kygalu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lalachloe.co.com.au ()"; content:"|09|lalachloe|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leeleesobieski.com (Malware_Infectors)"; content:"|0e|leeleesobieski|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legendgb.co.com.au ()"; content:"|08|legendgb|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loubnanioun.net (Malware_Infectors)"; content:"|0b|loubnanioun|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lpsnbzozyhvpepyp.info (Zeus_Zbot_SpyEye)"; content:"|10|lpsnbzozyhvpepyp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luhqkreavn.com (Malware_Infectors)"; content:"|0a|luhqkreavn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lvqdsuimvkxpuqro.com (Zeus_Zbot_SpyEye)"; content:"|10|lvqdsuimvkxpuqro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malibu4kofi.co.com.au ()"; content:"|0b|malibu4kofi|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mandjolt.cu.cc ()"; content:"|08|mandjolt|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup merca123.com (Malware_Distribution)"; content:"|08|merca123|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metaexploit.net (Malware_Infectors)"; content:"|0b|metaexploit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mfttwhmjqqmlqsuj.org (Zeus_Zbot_SpyEye)"; content:"|10|mfttwhmjqqmlqsuj|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup middlechrist.com ()"; content:"|0c|middlechrist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mitchwright.cu.cc ()"; content:"|0b|mitchwright|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nazeranyekta.com (Zeus_Zbot_SpyEye)"; content:"|0c|nazeranyekta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nhtwnelsnpkpmqm.com (Zeus_Zbot_SpyEye)"; content:"|0f|nhtwnelsnpkpmqm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niger20.hdfree.in (Malware_Infectors)"; content:"|07|niger20|06|hdfree|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noralvasanchez.com (Zeus_Zbot_SpyEye)"; content:"|0e|noralvasanchez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup numasa.com (Malware_Distribution)"; content:"|06|numasa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omwmsmoidwzmvql.net (Zeus_Zbot_SpyEye)"; content:"|0f|omwmsmoidwzmvql|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ortsgoonlwusotya.info (Zeus_Zbot_SpyEye)"; content:"|10|ortsgoonlwusotya|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oxygol.com (Malware_Distribution)"; content:"|06|oxygol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pgvvihoeerpnc.info (Zeus_Zbot_SpyEye)"; content:"|0d|pgvvihoeerpnc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piensaingles.com (Malware_Infectors)"; content:"|0c|piensaingles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planita.org (Zeus_Zbot_SpyEye)"; content:"|07|planita|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pubgraal.co.com.au ()"; content:"|08|pubgraal|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qoclick.dyndns.org (Zeus_Zbot_SpyEye)"; content:"|07|qoclick|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rapeisntfunny.info (Zeus_Zbot_SpyEye)"; content:"|0d|rapeisntfunny|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rchsl.info (Malware_Distribution)"; content:"|05|rchsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realjizz.cx.cc ()"; content:"|08|realjizz|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recipepaper.cx.cc ()"; content:"|0b|recipepaper|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup runobama.co.com.au ()"; content:"|08|runobama|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serv2.com (Zeus_Zbot_SpyEye)"; content:"|05|serv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serv3.com (Zeus_Zbot_SpyEye)"; content:"|05|serv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servers01.org (Zeus_Zbot_SpyEye)"; content:"|09|servers01|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sfkdhjnsfjg.ru (Malware_Distribution)"; content:"|0b|sfkdhjnsfjg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shalis.org (Zeus_Zbot_SpyEye)"; content:"|06|shalis|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slord.codzs.com (Zeus_Zbot_SpyEye)"; content:"|05|slord|05|codzs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socialcookery.com ()"; content:"|0d|socialcookery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solvota.com (Zeus_Zbot_SpyEye)"; content:"|07|solvota|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuntint.cu.cc ()"; content:"|08|stuntint|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup surfacechicago.net ()"; content:"|0e|surfacechicago|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tukpetta.co.com.au ()"; content:"|08|tukpetta|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tulsablast.co.com.au ()"; content:"|0a|tulsablast|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turbowatts.co.com.au ()"; content:"|0a|turbowatts|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbcbtpuvbvf.com (Malware_Infectors)"; content:"|0b|vbcbtpuvbvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vh1gear.cx.cc ()"; content:"|07|vh1gear|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtuacc.co.com.au ()"; content:"|08|virtuacc|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vtermjezz.com (Malware_Infectors)"; content:"|09|vtermjezz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wauffdevi.info ()"; content:"|09|wauffdevi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xewydduwru.co.com.au ()"; content:"|0a|xewydduwru|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhu33.wauffdevi.info ()"; content:"|05|xhu33|09|wauffdevi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoundtrack.co.com.au ()"; content:"|0a|zoundtrack|02|co|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bistrodom.msk.ru (Malware_Distribution)"; content:"|09|bistrodom|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7breaking-job-feeds.net (Malware_Distribution)"; content:"|13|7breaking-job-feeds|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7business-reporter.net (Malware_Distribution)"; content:"|12|7business-reporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7daily-homebusiness7.net (Malware_Distribution)"; content:"|14|7daily-homebusiness7|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7daily-jobs.net (Malware_Distribution)"; content:"|0b|7daily-jobs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7daily-mainstream.net (Malware_Distribution)"; content:"|11|7daily-mainstream|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7daily-reporter.net (Malware_Distribution)"; content:"|0f|7daily-reporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7dailyjob-reports.net (Malware_Distribution)"; content:"|11|7dailyjob-reports|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7dailyreporter.net (Malware_Distribution)"; content:"|0e|7dailyreporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7day-consultant.net (Malware_Distribution)"; content:"|0f|7day-consultant|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7job-dailynews2011.net (Malware_Distribution)"; content:"|12|7job-dailynews2011|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7job-reporter.net (Malware_Distribution)"; content:"|0d|7job-reporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7jobreporter.net (Malware_Distribution)"; content:"|0c|7jobreporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7newsweek.net (Malware_Distribution)"; content:"|09|7newsweek|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7report-7dailynews.net (Malware_Distribution)"; content:"|12|7report-7dailynews|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accidentsources.info (Malware_Distribution)"; content:"|0f|accidentsources|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accomplishmentpusho.info (Malware_Distribution)"; content:"|13|accomplishmentpusho|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accustomedactsl.info (Malware_Distribution)"; content:"|0f|accustomedactsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acknowledgebelievedd.info (Malware_Distribution)"; content:"|14|acknowledgebelievedd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acquaintancecanopyo.info (Malware_Distribution)"; content:"|13|acquaintancecanopyo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acquaintancesixo.info (Malware_Distribution)"; content:"|10|acquaintancesixo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aimsig.com (Malware_Distribution)"; content:"|06|aimsig|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akmholder11.com (Zeus_Zbot_SpyEye)"; content:"|0b|akmholder11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ashkanarchive.no-ip.biz (Malware_Distribution)"; content:"|0d|ashkanarchive|05|no-ip|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attentivelysinginga.info (Malware_Distribution)"; content:"|13|attentivelysinginga|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attitudedida.info (Malware_Distribution)"; content:"|0c|attitudedida|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attractedgrandeurd.info (Malware_Distribution)"; content:"|12|attractedgrandeurd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attractingalarmedo.info (Malware_Distribution)"; content:"|12|attractingalarmedo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attractserrandl.info (Malware_Distribution)"; content:"|0f|attractserrandl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup audacityconfusionz.info (Malware_Distribution)"; content:"|12|audacityconfusionz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup augustdeliberatei.info (Malware_Distribution)"; content:"|11|augustdeliberatei|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup augustimplacabley.info (Malware_Distribution)"; content:"|11|augustimplacabley|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup austeritiesbloody.info (Malware_Distribution)"; content:"|11|austeritiesbloody|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auto-kitchen.ru (Malware_Distribution)"; content:"|0c|auto-kitchen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avenuesmilez.info (Malware_Distribution)"; content:"|0c|avenuesmilez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awaitedfailsl.info (Malware_Distribution)"; content:"|0d|awaitedfailsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awetente.info (Malware_Distribution)"; content:"|08|awetente|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axkcxnz3hs.cx.cc (Zeus_Zbot_SpyEye)"; content:"|0a|axkcxnz3hs|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azoffrequents.info (Malware_Distribution)"; content:"|0d|azoffrequents|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azofsaintsu.info (Malware_Distribution)"; content:"|0b|azofsaintsu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babehighesty.info (Malware_Distribution)"; content:"|0c|babehighesty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup backknifez.info (Malware_Distribution)"; content:"|0a|backknifez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badconcludey.info (Malware_Distribution)"; content:"|0c|badconcludey|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badecomplaina.info (Malware_Distribution)"; content:"|0d|badecomplaina|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baderenewingy.info (Malware_Distribution)"; content:"|0d|baderenewingy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badpretexto.info (Malware_Distribution)"; content:"|0b|badpretexto|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ballsjointo.info (Malware_Distribution)"; content:"|0b|ballsjointo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bargepertainingi.info (Malware_Distribution)"; content:"|10|bargepertainingi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup batteryintelligentlyt.info (Malware_Distribution)"; content:"|15|batteryintelligentlyt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beardsdarkeneda.info (Malware_Distribution)"; content:"|0f|beardsdarkeneda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beardsprevaileds.info (Malware_Distribution)"; content:"|10|beardsprevaileds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beatarcs.info (Malware_Distribution)"; content:"|08|beatarcs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beautifulnoned.info (Malware_Distribution)"; content:"|0e|beautifulnoned|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beautyviolates.info (Malware_Distribution)"; content:"|0e|beautyviolates|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup becomerublesd.info (Malware_Distribution)"; content:"|0d|becomerublesd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedspeakersd.info (Malware_Distribution)"; content:"|0c|bedspeakersd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beervoodoo.com (Botnet_C&C)"; content:"|0a|beervoodoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beganquotad.info (Malware_Distribution)"; content:"|0b|beganquotad|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beginningscomportsi.info (Malware_Distribution)"; content:"|13|beginningscomportsi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beholderspartisanso.info (Malware_Distribution)"; content:"|13|beholderspartisanso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellexplaininga.info (Malware_Distribution)"; content:"|0f|bellexplaininga|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belonginginstantaneouslyi.info (Malware_Distribution)"; content:"|19|belonginginstantaneouslyi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belongsdignitariesd.info (Malware_Distribution)"; content:"|13|belongsdignitariesd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benchequerryy.info (Malware_Distribution)"; content:"|0d|benchequerryy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benchplannedy.info (Malware_Distribution)"; content:"|0d|benchplannedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestowingbanquetd.info (Malware_Distribution)"; content:"|11|bestowingbanquetd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betweendescendl.info (Malware_Distribution)"; content:"|0f|betweendescendl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bidprosperedi.info (Malware_Distribution)"; content:"|0d|bidprosperedi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biosolyara.ru (Malware_Distribution)"; content:"|0a|biosolyara|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup birdsaml.info (Malware_Distribution)"; content:"|08|birdsaml|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup birthdayinjuredy.info (Malware_Distribution)"; content:"|10|birthdayinjuredy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burunral233.in (Zeus_Zbot_SpyEye)"; content:"|0b|burunral233|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chilloutcaffee.net (Zeus_Zbot_SpyEye)"; content:"|0e|chilloutcaffee|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counter-wordpress.com (Malware_Distribution)"; content:"|11|counter-wordpress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curatenie-intretinere.ro ()"; content:"|15|curatenie-intretinere|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daphnesellshomes.sytes.net (Malware_Distribution)"; content:"|10|daphnesellshomes|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup database.wolf-lander.info (Malware_Infectors)"; content:"|08|database|0b|wolf-lander|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfenhfenj4ojf.com (Zeus_Zbot_SpyEye)"; content:"|0d|dfenhfenj4ojf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djayw.net.in (Zeus_Zbot_SpyEye)"; content:"|05|djayw|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doorprosdirect.com (Malware_Distribution)"; content:"|0e|doorprosdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doorspadesd.info (Malware_Distribution)"; content:"|0b|doorspadesd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downfallrobeza.info (Malware_Distribution)"; content:"|0e|downfallrobeza|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drearyhostiled.info (Malware_Distribution)"; content:"|0e|drearyhostiled|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dressedtimei.info (Malware_Distribution)"; content:"|0c|dressedtimei|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drinkingtaskl.info (Malware_Distribution)"; content:"|0d|drinkingtaskl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropunworthyl.info (Malware_Distribution)"; content:"|0d|dropunworthyl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drummerjulyl.info (Malware_Distribution)"; content:"|0c|drummerjulyl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ducatswarmlyd.info (Malware_Distribution)"; content:"|0d|ducatswarmlyd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dueresidences.info (Malware_Distribution)"; content:"|0d|dueresidences|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dust.wxhelz.net (Zeus_Zbot_SpyEye)"; content:"|04|dust|06|wxhelz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dutysuddenlyi.info (Malware_Distribution)"; content:"|0d|dutysuddenlyi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwarfjusts.info (Malware_Distribution)"; content:"|0a|dwarfjusts|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwarfsons.info (Malware_Distribution)"; content:"|09|dwarfsons|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynastieslooky.info (Malware_Distribution)"; content:"|0e|dynastieslooky|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynastiesspott.info (Malware_Distribution)"; content:"|0e|dynastiesspott|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eachnorthern.info (Malware_Distribution)"; content:"|0c|eachnorthern|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eagersuspectedl.info (Malware_Distribution)"; content:"|0f|eagersuspectedl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earlyreluctanti.info (Malware_Distribution)"; content:"|0f|earlyreluctanti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earnconstitutionsy.info (Malware_Distribution)"; content:"|12|earnconstitutionsy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earningsfoundationsa.info (Malware_Distribution)"; content:"|14|earningsfoundationsa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easereliances.info (Malware_Distribution)"; content:"|0d|easereliances|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easilyrumanrowi.info (Malware_Distribution)"; content:"|0f|easilyrumanrowi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eastforgeti.info (Malware_Distribution)"; content:"|0b|eastforgeti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eastwardevasivel.info (Malware_Distribution)"; content:"|10|eastwardevasivel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eatingpretendl.info (Malware_Distribution)"; content:"|0e|eatingpretendl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecclesiasticsappliancesd.info (Malware_Distribution)"; content:"|18|ecclesiasticsappliancesd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecomersik.com (Zeus_Zbot_SpyEye)"; content:"|09|ecomersik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elcoluna.mobi (Zeus_Zbot_SpyEye)"; content:"|08|elcoluna|04|mobi"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exposuresalariedo.info (Malware_Distribution)"; content:"|11|exposuresalariedo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expressionsdissatisfactiony.info (Malware_Distribution)"; content:"|1b|expressionsdissatisfactiony|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expulsionshipl.info (Malware_Distribution)"; content:"|0e|expulsionshipl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extensivehappenedy.info (Malware_Distribution)"; content:"|12|extensivehappenedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extensiverenderso.info (Malware_Distribution)"; content:"|11|extensiverenderso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eye.b0x.su (Zeus_Zbot_SpyEye)"; content:"|03|eye|03|b0x|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fabricatedindolencez.info (Malware_Distribution)"; content:"|14|fabricatedindolencez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facilitiescarriaged.info (Malware_Distribution)"; content:"|13|facilitiescarriaged|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facilitieseasterny.info (Malware_Distribution)"; content:"|12|facilitieseasterny|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fadedalongo.info (Malware_Distribution)"; content:"|0b|fadedalongo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-advertisement.net (Zeus_Zbot_SpyEye)"; content:"|12|fast-advertisement|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastertraders.net (Zeus_Zbot_SpyEye)"; content:"|0d|fastertraders|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-housemany.ru (Malware_Distribution)"; content:"|0e|file-housemany|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup find-many-file.ru (Malware_Distribution)"; content:"|0e|find-many-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstfq-checker.in (Malware_Distribution)"; content:"|0f|firstfq-checker|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forwardmotionconcepts.com (Zeus_Zbot_SpyEye)"; content:"|15|forwardmotionconcepts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup furniturebaded.info (Malware_Distribution)"; content:"|0e|furniturebaded|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gainedstrugglel.info (Malware_Distribution)"; content:"|0f|gainedstrugglel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gainingsubjectedi.info (Malware_Distribution)"; content:"|11|gainingsubjectedi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galitzinreasons.info (Malware_Distribution)"; content:"|0f|galitzinreasons|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gallery-plus.net (Malware_Distribution)"; content:"|0c|gallery-plus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gancetode.com (Zeus_Zbot_SpyEye)"; content:"|09|gancetode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gardensmistressl.info (Malware_Distribution)"; content:"|10|gardensmistressl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup garrisonedcelebrationsy.info (Malware_Distribution)"; content:"|17|garrisonedcelebrationsy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generationsruind.info (Malware_Distribution)"; content:"|10|generationsruind|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generousboxesd.info (Malware_Distribution)"; content:"|0e|generousboxesd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generousuniversallyl.info (Malware_Distribution)"; content:"|14|generousuniversallyl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genevaillnessi.info (Malware_Distribution)"; content:"|0e|genevaillnessi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerulisdedas.com (Zeus_Zbot_SpyEye)"; content:"|0c|gerulisdedas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getcouponow.com (Zeus_Zbot_SpyEye)"; content:"|0b|getcouponow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup global-traff.com (Malware_Distribution)"; content:"|0c|global-traff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gohaen.info (Malware_Distribution)"; content:"|06|gohaen|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlesafebrowsing.com (Malware_Distribution)"; content:"|12|googlesafebrowsing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haspo6lita.com (Zeus_Zbot_SpyEye)"; content:"|0a|haspo6lita|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hertulna-bestdeal.com (Zeus_Zbot_SpyEye)"; content:"|11|hertulna-bestdeal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hlasdnfasd.cx.cc (Zeus_Zbot_SpyEye)"; content:"|0a|hlasdnfasd|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huteraq.com (Zeus_Zbot_SpyEye)"; content:"|07|huteraq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igrajvpas.com (Zeus_Zbot_SpyEye)"; content:"|09|igrajvpas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infro.anexelymoweq.in (Zeus_Zbot_SpyEye)"; content:"|05|infro|0c|anexelymoweq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irs-report-online.com (Zeus_Zbot_SpyEye)"; content:"|11|irs-report-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jcmtczpwontvppnt.org (Zeus_Zbot_SpyEye)"; content:"|10|jcmtczpwontvppnt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keppeo.com (Zeus_Zbot_SpyEye)"; content:"|06|keppeo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kualulumpuru223.com (Zeus_Zbot_SpyEye)"; content:"|0f|kualulumpuru223|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lanlabs.net (Zeus_Zbot_SpyEye)"; content:"|07|lanlabs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lasbok.com (Zeus_Zbot_SpyEye)"; content:"|06|lasbok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laso5palop.com (Zeus_Zbot_SpyEye)"; content:"|0a|laso5palop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lgusezgrgogtpzo.org (Zeus_Zbot_SpyEye)"; content:"|0f|lgusezgrgogtpzo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovevirtualmotion.com (Malware_Distribution)"; content:"|11|lovevirtualmotion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lqpiptontyynvrp.biz (Zeus_Zbot_SpyEye)"; content:"|0f|lqpiptontyynvrp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lsclick.net (Zeus_Zbot_SpyEye)"; content:"|07|lsclick|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup market.ecommrs.info (Zeus_Zbot_SpyEye)"; content:"|06|market|07|ecommrs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mejerlahome2.com (Zeus_Zbot_SpyEye)"; content:"|0c|mejerlahome2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milinewo.be (Zeus_Zbot_SpyEye)"; content:"|08|milinewo|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moun1r.co.cc (Zeus_Zbot_SpyEye)"; content:"|06|moun1r|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ms-stats.info (Zeus_Zbot_SpyEye)"; content:"|08|ms-stats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musiictochapman.us.to (Malware_Distribution)"; content:"|0f|musiictochapman|02|us|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mwqmyghkstuvksu.info (Zeus_Zbot_SpyEye)"; content:"|0f|mwqmyghkstuvksu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mydocuments4you4.com (Zeus_Zbot_SpyEye)"; content:"|10|mydocuments4you4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myrestricted.info (Zeus_Zbot_SpyEye)"; content:"|0c|myrestricted|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup needaysafe.in (Malware_Distribution)"; content:"|0a|needaysafe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup needdesafe.in (Malware_Distribution)"; content:"|0a|needdesafe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nopduauga.co.tv (Malware_Distribution)"; content:"|09|nopduauga|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns-creative.com (Zeus_Zbot_SpyEye)"; content:"|0b|ns-creative|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogromniypornoarchiv.ru (Malware_Distribution)"; content:"|13|ogromniypornoarchiv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okao3.uni.cc (Zeus_Zbot_SpyEye)"; content:"|05|okao3|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oraltablets.info (Zeus_Zbot_SpyEye)"; content:"|0b|oraltablets|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orangeblue.cl (Malware_Distribution)"; content:"|0a|orangeblue|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oskrpqgtngporxdw.biz (Zeus_Zbot_SpyEye)"; content:"|10|oskrpqgtngporxdw|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otorviseberukumudak.com (Zeus_Zbot_SpyEye)"; content:"|13|otorviseberukumudak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-international.ru (Malware_Distribution)"; content:"|10|pc-international|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petrovsky383.com (Zeus_Zbot_SpyEye)"; content:"|0c|petrovsky383|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qtylujrrlnmvonq.com (Zeus_Zbot_SpyEye)"; content:"|0f|qtylujrrlnmvonq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quimicaederivados.com.br (Malware_Distribution)"; content:"|11|quimicaederivados|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rlpokjmnhcimtkiz.net (Zeus_Zbot_SpyEye)"; content:"|10|rlpokjmnhcimtkiz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rokqsjhzyiusvrj.info (Zeus_Zbot_SpyEye)"; content:"|0f|rokqsjhzyiusvrj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sb.degreesbuy.com (Malware_Distribution)"; content:"|02|sb|0a|degreesbuy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seosh4us.com (Zeus_Zbot_SpyEye)"; content:"|08|seosh4us|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shirlgkmlodwmxt.info (Zeus_Zbot_SpyEye)"; content:"|0f|shirlgkmlodwmxt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statistictoolbox.com (Zeus_Zbot_SpyEye)"; content:"|10|statistictoolbox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suiteprevaile.info (Malware_Distribution)"; content:"|0d|suiteprevaile|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sum-tec.com (Malware_Distribution)"; content:"|07|sum-tec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup summonedilluminede.info (Malware_Distribution)"; content:"|12|summonedilluminede|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup surmountedimplicatede.info (Malware_Distribution)"; content:"|15|surmountedimplicatede|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup surplusrefusey.info (Malware_Distribution)"; content:"|0e|surplusrefusey|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swedendiscomfortse.info (Malware_Distribution)"; content:"|12|swedendiscomfortse|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swedestriedl.info (Malware_Distribution)"; content:"|0c|swedestriedl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theimageshare.com (Zeus_Zbot_SpyEye)"; content:"|0d|theimageshare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timgad1.com (Zeus_Zbot_SpyEye)"; content:"|07|timgad1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolbarqueries-google.com (Malware_Distribution)"; content:"|15|toolbarqueries-google|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topguarduo.in (Malware_Distribution)"; content:"|0a|topguarduo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vielkind.at (Malware_Distribution)"; content:"|08|vielkind|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrtpqhwlwsgyufto.biz (Zeus_Zbot_SpyEye)"; content:"|10|wrtpqhwlwsgyufto|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wungrp.com (Malware_Distribution)"; content:"|06|wungrp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxporno4u.ru (Malware_Distribution)"; content:"|0a|xxxporno4u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ygnlgxyzamfxvlt.info (Zeus_Zbot_SpyEye)"; content:"|0f|ygnlgxyzamfxvlt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yozkwnpizzzconi.net (Zeus_Zbot_SpyEye)"; content:"|0f|yozkwnpizzzconi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yvumernhqpnqtxx.biz (Zeus_Zbot_SpyEye)"; content:"|0f|yvumernhqpnqtxx|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1520mm.com (Zeus_Zbot_SpyEye)"; content:"|06|1520mm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 87vfnr4.tk ()"; content:"|07|87vfnr4|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amerdux.cu.cc ()"; content:"|07|amerdux|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asdfadgtyuyipfgjns.cx.cc (Zeus_Zbot_SpyEye)"; content:"|12|asdfadgtyuyipfgjns|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assembliessteert.info (Malware_Distribution)"; content:"|10|assembliessteert|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup associateregulars.info (Malware_Distribution)"; content:"|11|associateregulars|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attachednorl.info (Malware_Distribution)"; content:"|0c|attachednorl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attentionsdevelopedo.info (Malware_Distribution)"; content:"|14|attentionsdevelopedo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aurdrpvbrkvmmnk.info (Zeus_Zbot_SpyEye)"; content:"|0f|aurdrpvbrkvmmnk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbulitwrvlmqto.biz (Zeus_Zbot_SpyEye)"; content:"|0e|bbulitwrvlmqto|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitproportionatel.info (Malware_Distribution)"; content:"|11|bitproportionatel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitstrictlyl.info (Malware_Distribution)"; content:"|0c|bitstrictlyl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitternessplottersi.info (Malware_Distribution)"; content:"|13|bitternessplottersi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blessingparleyo.info (Malware_Distribution)"; content:"|0f|blessingparleyo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blowgranariesl.info (Malware_Distribution)"; content:"|0e|blowgranariesl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blowsfrightso.info (Malware_Distribution)"; content:"|0d|blowsfrightso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blowsinstructionsa.info (Malware_Distribution)"; content:"|12|blowsinstructionsa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boardbelonginga.info (Malware_Distribution)"; content:"|0f|boardbelonginga|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boiarsrejoindert.info (Malware_Distribution)"; content:"|10|boiarsrejoindert|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bombgonez.info (Malware_Distribution)"; content:"|09|bombgonez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonfiresmountedt.info (Malware_Distribution)"; content:"|10|bonfiresmountedt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booksfirmlys.info (Malware_Distribution)"; content:"|0c|booksfirmlys|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookssiny.info (Malware_Distribution)"; content:"|09|bookssiny|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boundrenunciations.info (Malware_Distribution)"; content:"|12|boundrenunciations|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bowpresentedy.info (Malware_Distribution)"; content:"|0d|bowpresentedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collective-media.ne (Malware_Distribution)"; content:"|10|collective-media|02|ne"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup considerablelawsi.info (Malware_Distribution)"; content:"|11|considerablelawsi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup considerationuncontrollables.info (Malware_Distribution)"; content:"|1c|considerationuncontrollables|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup consmudowke.servequake.com ()"; content:"|0b|consmudowke|0a|servequake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conspicuousprecessions.info (Malware_Distribution)"; content:"|16|conspicuousprecessions|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup constanttooky.info (Malware_Distribution)"; content:"|0d|constanttooky|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup constitutionsrepudiateda.info (Malware_Distribution)"; content:"|18|constitutionsrepudiateda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup containedkeept.info (Malware_Distribution)"; content:"|0e|containedkeept|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup containintercessiono.info (Malware_Distribution)"; content:"|14|containintercessiono|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cooperategroupinc.com (Phishing_and_Theft)"; content:"|11|cooperategroupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup credadgranam.redirectme.net ()"; content:"|0c|credadgranam|0a|redirectme|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dcfjctykdyywrth.c0m.li (Malware_Distribution)"; content:"|0f|dcfjctykdyywrth|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhilatbuso.servemp3.com ()"; content:"|0a|dhilatbuso|08|servemp3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diaviegira.servemp3.com ()"; content:"|0a|diaviegira|08|servemp3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup distastedeliversy.info (Malware_Distribution)"; content:"|11|distastedeliversy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup distressamusementy.info (Malware_Distribution)"; content:"|12|distressamusementy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup divisionempirest.info (Malware_Distribution)"; content:"|10|divisionempirest|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup divulgekneesi.info (Malware_Distribution)"; content:"|0d|divulgekneesi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dldslauno.com (Malware_Distribution)"; content:"|09|dldslauno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnsmanagement.at.tc ()"; content:"|0d|dnsmanagement|02|at|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dociletreatingi.info (Malware_Distribution)"; content:"|0f|dociletreatingi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domainsdisciplinedy.info (Malware_Distribution)"; content:"|13|domainsdisciplinedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domainsecurenethp.com (Malware_Distribution)"; content:"|11|domainsecurenethp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dtpaoqoyopgxnrun.info (Zeus_Zbot_SpyEye)"; content:"|10|dtpaoqoyopgxnrun|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecclesiasticsintoxicatedd.info (Malware_Distribution)"; content:"|19|ecclesiasticsintoxicatedd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecclesiasticsusl.info (Malware_Distribution)"; content:"|10|ecclesiasticsusl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup effectedroutinel.info (Malware_Distribution)"; content:"|10|effectedroutinel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup effectingrequestl.info (Malware_Distribution)"; content:"|11|effectingrequestl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup effectivedestitutei.info (Malware_Distribution)"; content:"|13|effectivedestitutei|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup effectualendl.info (Malware_Distribution)"; content:"|0d|effectualendl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup effectuallystratagemsl.info (Malware_Distribution)"; content:"|16|effectuallystratagemsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup effers.com (Malware_Infectors)"; content:"|06|effers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eighteenproceedede.info (Malware_Distribution)"; content:"|12|eighteenproceedede|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eithergibbety.info (Malware_Distribution)"; content:"|0d|eithergibbety|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup empiksmwmqfooa.info (Zeus_Zbot_SpyEye)"; content:"|0e|empiksmwmqfooa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esldmozsythhti.info (Zeus_Zbot_SpyEye)"; content:"|0e|esldmozsythhti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evromonter.ru ()"; content:"|0a|evromonter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalreserve-online.com (Zeus_Zbot_SpyEye)"; content:"|15|federalreserve-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedralwire-report.com (Zeus_Zbot_SpyEye)"; content:"|11|fedralwire-report|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frailenforcee.info (Malware_Distribution)"; content:"|0d|frailenforcee|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friendlesssteamery.info (Malware_Distribution)"; content:"|12|friendlesssteamery|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friendlyvisitso.info (Malware_Distribution)"; content:"|0f|friendlyvisitso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friendshipsilvers.info (Malware_Distribution)"; content:"|11|friendshipsilvers|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frontispiecebells.info (Malware_Distribution)"; content:"|11|frontispiecebells|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frontispiecereposingi.info (Malware_Distribution)"; content:"|15|frontispiecereposingi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fulfillplumesl.info (Malware_Distribution)"; content:"|0e|fulfillplumesl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup furiouslywhenevero.info (Malware_Distribution)"; content:"|12|furiouslywhenevero|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup furnishtourt.info (Malware_Distribution)"; content:"|0c|furnishtourt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fututka20.com ()"; content:"|09|fututka20|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geniscuta.zapto.org ()"; content:"|09|geniscuta|05|zapto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gentlemanxiva.info (Malware_Distribution)"; content:"|0d|gentlemanxiva|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup germanyappointedt.info (Malware_Distribution)"; content:"|11|germanyappointedt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getscircumstancez.info (Malware_Distribution)"; content:"|11|getscircumstancez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getstudieds.info (Malware_Distribution)"; content:"|0b|getstudieds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gluckexcitementi.info (Malware_Distribution)"; content:"|10|gluckexcitementi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gluttedgirlsy.info (Malware_Distribution)"; content:"|0d|gluttedgirlsy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gluttedskillfullyz.info (Malware_Distribution)"; content:"|12|gluttedskillfullyz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gluttedsovereignsi.info (Malware_Distribution)"; content:"|12|gluttedsovereignsi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godfathersobtains.info (Malware_Distribution)"; content:"|11|godfathersobtains|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goforwatches.net (Malware_Distribution)"; content:"|0c|goforwatches|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gopota.net ()"; content:"|06|gopota|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtuyhkitywrtwerg.c0m.li (Malware_Distribution)"; content:"|10|gtuyhkitywrtwerg|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infirmgenerala.info (Malware_Distribution)"; content:"|0e|infirmgenerala|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infirmkingdomsa.info (Malware_Distribution)"; content:"|0f|infirmkingdomsa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inflamedabsolutenessy.info (Malware_Distribution)"; content:"|15|inflamedabsolutenessy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup informaldiscontentedl.info (Malware_Distribution)"; content:"|15|informaldiscontentedl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup injusticecontinuationy.info (Malware_Distribution)"; content:"|16|injusticecontinuationy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inpiet.info (Malware_Distribution)"; content:"|06|inpiet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insensiblyflyi.info (Malware_Distribution)"; content:"|0e|insensiblyflyi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insinuatinguponi.info (Malware_Distribution)"; content:"|10|insinuatinguponi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instancesrowd.info (Malware_Distribution)"; content:"|0d|instancesrowd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instigatorthenced.info (Malware_Distribution)"; content:"|11|instigatorthenced|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instructingdistinguishedi.info (Malware_Distribution)"; content:"|19|instructingdistinguishedi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instrumentsamplel.info (Malware_Distribution)"; content:"|11|instrumentsamplel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irs-urgentreport.com (Malware_Distribution)"; content:"|10|irs-urgentreport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jealousslows.info (Malware_Distribution)"; content:"|0c|jealousslows|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jesteropinionse.info (Malware_Distribution)"; content:"|0f|jesteropinionse|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhghjghqjjsmjsux.c0m.li (Malware_Distribution)"; content:"|10|jhghjghqjjsmjsux|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jifr.co.be ()"; content:"|04|jifr|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jifr.co.cc ()"; content:"|04|jifr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jifr.info ()"; content:"|04|jifr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jimjock.ru (Malware_Distribution)"; content:"|07|jimjock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-7daily-report.net (Malware_Distribution)"; content:"|11|job-7daily-report|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-7reports.net (Malware_Distribution)"; content:"|0c|job-7reports|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-7revolution.net (Malware_Distribution)"; content:"|0f|job-7revolution|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-news365.net (Malware_Distribution)"; content:"|0b|job-news365|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-newsexpress.net (Malware_Distribution)"; content:"|0f|job-newsexpress|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-newspaper.net (Malware_Distribution)"; content:"|0d|job-newspaper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-newspress.net (Malware_Distribution)"; content:"|0d|job-newspress|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-onlinejournal.net (Malware_Distribution)"; content:"|11|job-onlinejournal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johnylee.strangled.net (Malware_Distribution)"; content:"|08|johnylee|09|strangled|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jvyjpitigroplppi.biz (Zeus_Zbot_SpyEye)"; content:"|10|jvyjpitigroplppi|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyojizrjuhikxyt.info (Zeus_Zbot_SpyEye)"; content:"|0f|jyojizrjuhikxyt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knnjnwrshqwvjvb.biz (Malware_Distribution)"; content:"|0f|knnjnwrshqwvjvb|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knnjnwrshqwvjvb.net (Malware_Distribution)"; content:"|0f|knnjnwrshqwvjvb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kotplhqxotlzgzpt.org (Zeus_Zbot_SpyEye)"; content:"|10|kotplhqxotlzgzpt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kvdngrwipfbpyctr.com (Zeus_Zbot_SpyEye)"; content:"|10|kvdngrwipfbpyctr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwhmqszpvttoiglm.info (Zeus_Zbot_SpyEye)"; content:"|10|kwhmqszpvttoiglm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup link-irs-report.com (Malware_Distribution)"; content:"|0f|link-irs-report|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkedin-downloads.com (Malware_Distribution)"; content:"|12|linkedin-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkedin-file-reports.com (Malware_Distribution)"; content:"|15|linkedin-file-reports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lnesimciche.servehalflife.com ()"; content:"|0b|lnesimciche|0d|servehalflife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lvvokqmjrkxpqvln.info (Zeus_Zbot_SpyEye)"; content:"|10|lvvokqmjrkxpqvln|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mantraorderto.com (Zeus_Zbot_SpyEye)"; content:"|0d|mantraorderto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marhandconsba.myftp.biz ()"; content:"|0d|marhandconsba|05|myftp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meelith.com (Botnet_C&C)"; content:"|07|meelith|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup melanomailia.in (Botnet_C&C)"; content:"|0c|melanomailia|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup menraducvoort.servepics.com ()"; content:"|0d|menraducvoort|09|servepics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monasteriesunofficiallys.info (Malware_Distribution)"; content:"|18|monasteriesunofficiallys|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monasticpromisingi.info (Malware_Distribution)"; content:"|12|monasticpromisingi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moralentreatiesi.info (Malware_Distribution)"; content:"|10|moralentreatiesi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moralsperformancey.info (Malware_Distribution)"; content:"|12|moralsperformancey|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mostlyprogressl.info (Malware_Distribution)"; content:"|0f|mostlyprogressl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motivesignatured.info (Malware_Distribution)"; content:"|10|motivesignatured|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mouldadmirablye.info (Malware_Distribution)"; content:"|0f|mouldadmirablye|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mountingheightt.info (Malware_Distribution)"; content:"|0f|mountingheightt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moveddescenda.info (Malware_Distribution)"; content:"|0d|moveddescenda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieboxcentral.in (Botnet_C&C)"; content:"|0f|movieboxcentral|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mydigibird.com (Botnet_C&C)"; content:"|0a|mydigibird|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysterydebarreds.info (Malware_Distribution)"; content:"|10|mysterydebarreds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namedideaz.info (Malware_Distribution)"; content:"|0a|namedideaz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namelydurabled.info (Malware_Distribution)"; content:"|0e|namelydurabled|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup narrowlymeltedy.info (Malware_Distribution)"; content:"|0f|narrowlymeltedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nataliafoese.info (Malware_Distribution)"; content:"|0c|nataliafoese|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nationaldefeaty.info (Malware_Distribution)"; content:"|0f|nationaldefeaty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nationaloutlety.info (Malware_Distribution)"; content:"|0f|nationaloutlety|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nationsweetso.info (Malware_Distribution)"; content:"|0d|nationsweetso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nearlyemployedi.info (Malware_Distribution)"; content:"|0f|nearlyemployedi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup news7online.in (Malware_Distribution)"; content:"|0b|news7online|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nineinclosedd.info (Malware_Distribution)"; content:"|0d|nineinclosedd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ninenegotiationsd.info (Malware_Distribution)"; content:"|11|ninenegotiationsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nocompaniess.info (Malware_Distribution)"; content:"|0c|nocompaniess|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nonundertakeno.info (Malware_Distribution)"; content:"|0e|nonundertakeno|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordisappointments.info (Malware_Distribution)"; content:"|12|nordisappointments|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup northwardfalsehoods.info (Malware_Distribution)"; content:"|13|northwardfalsehoods|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nucleardiscover.com (Malware_Distribution)"; content:"|0f|nucleardiscover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohumyljwmkttsorr.biz (Zeus_Zbot_SpyEye)"; content:"|10|ohumyljwmkttsorr|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohypsspuuitlruf.org (Zeus_Zbot_SpyEye)"; content:"|0f|ohypsspuuitlruf|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ookimemxjkpxoy.com (Zeus_Zbot_SpyEye)"; content:"|0e|ookimemxjkpxoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opposedpullingi.info (Malware_Distribution)"; content:"|0f|opposedpullingi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opposingwheele.info (Malware_Distribution)"; content:"|0e|opposingwheele|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oppositiontraitorouslyy.info (Malware_Distribution)"; content:"|17|oppositiontraitorouslyy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orderssteerd.info (Malware_Distribution)"; content:"|0c|orderssteerd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ordinarytooz.info (Malware_Distribution)"; content:"|0c|ordinarytooz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup organizingplottinga.info (Malware_Distribution)"; content:"|13|organizingplottinga|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oruliukdkiopnt.biz (Zeus_Zbot_SpyEye)"; content:"|0e|oruliukdkiopnt|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ozneostgsvxntwl.biz (Zeus_Zbot_SpyEye)"; content:"|0f|ozneostgsvxntwl|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pergifttheci.servepics.com ()"; content:"|0c|pergifttheci|09|servepics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perhingr.com (Malware_Distribution)"; content:"|08|perhingr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pirppqhpruoiu.biz (Zeus_Zbot_SpyEye)"; content:"|0d|pirppqhpruoiu|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjisjgifnvwtmqi.com (Zeus_Zbot_SpyEye)"; content:"|0f|pjisjgifnvwtmqi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppnkwphvrrdonhe.org (Zeus_Zbot_SpyEye)"; content:"|0f|ppnkwphvrrdonhe|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pqcpmlxrusrwsipv.info (Zeus_Zbot_SpyEye)"; content:"|10|pqcpmlxrusrwsipv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qfsl.co.be ()"; content:"|04|qfsl|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qfsl.co.cc ()"; content:"|04|qfsl|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qfsl.net ()"; content:"|04|qfsl|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qimqzrtpkmukd.com (Zeus_Zbot_SpyEye)"; content:"|0d|qimqzrtpkmukd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qnknuwletqgixvjk.com (Zeus_Zbot_SpyEye)"; content:"|10|qnknuwletqgixvjk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqxoequwsvqjsp.info (Zeus_Zbot_SpyEye)"; content:"|0e|qqxoequwsvqjsp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup queyocero.in (Botnet_C&C)"; content:"|09|queyocero|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redspacetube.com (Fake_AV)"; content:"|0c|redspacetube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regarnoodle.in (Botnet_C&C)"; content:"|0b|regarnoodle|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reportaccxs.com (Botnet_C&C)"; content:"|0b|reportaccxs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rgeixhnqprprqqhu.info (Zeus_Zbot_SpyEye)"; content:"|10|rgeixhnqprprqqhu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rhqpihygijvkndzu.com (Zeus_Zbot_SpyEye)"; content:"|10|rhqpihygijvkndzu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rydergen.in (Botnet_C&C)"; content:"|08|rydergen|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scoke.net (Botnet_C&C)"; content:"|05|scoke|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup senhyva.in (Botnet_C&C)"; content:"|07|senhyva|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup severallystockd.info (Malware_Distribution)"; content:"|0f|severallystockd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shallowsowz.info (Malware_Distribution)"; content:"|0b|shallowsowz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sharedpenetrateds.info (Malware_Distribution)"; content:"|11|sharedpenetrateds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sharetearsy.info (Malware_Distribution)"; content:"|0b|sharetearsy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sheepacknowledgei.info (Malware_Distribution)"; content:"|11|sheepacknowledgei|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sheetthiso.info (Malware_Distribution)"; content:"|0a|sheetthiso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop-europe-staff.net (Malware_Distribution)"; content:"|11|shop-europe-staff|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop-europe.net (Malware_Distribution)"; content:"|0b|shop-europe|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shovelsouters.info (Malware_Distribution)"; content:"|0d|shovelsouters|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shufflebuzz.net (Botnet_C&C)"; content:"|0b|shufflebuzz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shutassociated.info (Malware_Distribution)"; content:"|0e|shutassociated|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skindoonline.in (Botnet_C&C)"; content:"|0c|skindoonline|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skipolice.net (Botnet_C&C)"; content:"|09|skipolice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skislia.com (Botnet_C&C)"; content:"|07|skislia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skiyoresorts.com (Botnet_C&C)"; content:"|0c|skiyoresorts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skiyoresorts.in (Botnet_C&C)"; content:"|0c|skiyoresorts|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skyta.net (Botnet_C&C)"; content:"|05|skyta|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smpjsueigtqn.net (Zeus_Zbot_SpyEye)"; content:"|0c|smpjsueigtqn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwareholiday.com (Malware_Distribution)"; content:"|0f|softwareholiday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soundchat.in (Botnet_C&C)"; content:"|09|soundchat|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starmediainfo.in (Botnet_C&C)"; content:"|0d|starmediainfo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumqrvgmvmbspic.info (Zeus_Zbot_SpyEye)"; content:"|0f|sumqrvgmvmbspic|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thoughtcable.com (Botnet_C&C)"; content:"|0c|thoughtcable|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thoughtxs.in (Botnet_C&C)"; content:"|09|thoughtxs|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tqowirmgkqloxyi.biz (Zeus_Zbot_SpyEye)"; content:"|0f|tqowirmgkqloxyi|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trquebec.in (Botnet_C&C)"; content:"|08|trquebec|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truafghanistan.com (Botnet_C&C)"; content:"|0e|truafghanistan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsksruhpkqrwvsv.info (Zeus_Zbot_SpyEye)"; content:"|0f|tsksruhpkqrwvsv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsyspmsvpjssfhfi.com (Zeus_Zbot_SpyEye)"; content:"|10|tsyspmsvpjssfhfi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup udp-first.com ()"; content:"|09|udp-first|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhertuupjsfjdryt.com (Zeus_Zbot_SpyEye)"; content:"|10|uhertuupjsfjdryt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vlvvrlczgsmnggi.net (Zeus_Zbot_SpyEye)"; content:"|0f|vlvvrlczgsmnggi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vujcikrbvomptrtm.biz (Zeus_Zbot_SpyEye)"; content:"|10|vujcikrbvomptrtm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waitforminute.bz.cm ()"; content:"|0d|waitforminute|02|bz|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waitforsecond.bz.cm ()"; content:"|0d|waitforsecond|02|bz|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waitplz.bz.cm ()"; content:"|07|waitplz|02|bz|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup welthongnali.servebeer.com ()"; content:"|0c|welthongnali|09|servebeer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wfbpumtimluzt.net (Zeus_Zbot_SpyEye)"; content:"|0d|wfbpumtimluzt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whogoeswhen.co (Malware_Distribution)"; content:"|0b|whogoeswhen|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wozhrlrlqwshnmr.com (Zeus_Zbot_SpyEye)"; content:"|0f|wozhrlrlqwshnmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhulvttkyunjtx.biz (Zeus_Zbot_SpyEye)"; content:"|0e|xhulvttkyunjtx|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yfllwhtek.dns1.us (Malware_Distribution)"; content:"|09|yfllwhtek|04|dns1|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yxpnxkzmfszqloli.org (Zeus_Zbot_SpyEye)"; content:"|10|yxpnxkzmfszqloli|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zplvozprvioejmi.org (Zeus_Zbot_SpyEye)"; content:"|0f|zplvozprvioejmi|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zpxqfqsqnkkysmtu.org (Zeus_Zbot_SpyEye)"; content:"|10|zpxqfqsqnkkysmtu|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsqtvwhlyjzrskv.org (Zeus_Zbot_SpyEye)"; content:"|0f|zsqtvwhlyjzrskv|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ztovpyprnnwhwsws.net (Zeus_Zbot_SpyEye)"; content:"|10|ztovpyprnnwhwsws|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtuta.ru (Malware_Distribution)"; content:"|07|virtuta|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mijn-roedel.be (Malware_Distribution)"; content:"|0b|mijn-roedel|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-cheats.de ()"; content:"|09|pc-cheats|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrbrothers.com (Malware_Distribution)"; content:"|0a|vrbrothers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2680.com (Malware_Infectors)"; content:"|04|2680|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7k7k.com (Malware_Infectors)"; content:"|04|7k7k|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acialisforsale.com (SEO_Fraud)"; content:"|0e|acialisforsale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acialisforsale.net (SEO_Fraud)"; content:"|0e|acialisforsale|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adviesgroepict-pcou.nl (Malware_Infectors)"; content:"|13|adviesgroepict-pcou|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agneserozanne.com (SEO_Fraud)"; content:"|0d|agneserozanne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aguyet47td.com (Malware_Infectors)"; content:"|0a|aguyet47td|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aidanrosaline.com (SEO_Fraud)"; content:"|0d|aidanrosaline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allisonjackqueline.com (SEO_Fraud)"; content:"|12|allisonjackqueline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allnokia.ru (Malware_Infectors)"; content:"|08|allnokia|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almakelsy.com (SEO_Fraud)"; content:"|09|almakelsy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almeriahilda.com (SEO_Fraud)"; content:"|0c|almeriahilda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almiramaighdiln.com (SEO_Fraud)"; content:"|0f|almiramaighdiln|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alysongeorgiana.com (SEO_Fraud)"; content:"|0f|alysongeorgiana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amalepharmacy.com (SEO_Fraud)"; content:"|0d|amalepharmacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anselmarivy.com (SEO_Fraud)"; content:"|0b|anselmarivy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ardysmoll.com (SEO_Fraud)"; content:"|09|ardysmoll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aridathacrissy.com (SEO_Fraud)"; content:"|0e|aridathacrissy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ariellephil.com (SEO_Fraud)"; content:"|0b|ariellephil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup audriedemetria.com (SEO_Fraud)"; content:"|0e|audriedemetria|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup austinegwendolen.com (SEO_Fraud)"; content:"|10|austinegwendolen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aviagraforsale.com (SEO_Fraud)"; content:"|0e|aviagraforsale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aviagraforsale.net (SEO_Fraud)"; content:"|0e|aviagraforsale|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsecurecs.com (Spyware)"; content:"|0a|avsecurecs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babbettekeriann.com (SEO_Fraud)"; content:"|0f|babbettekeriann|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babesloveit.com (SEO_Fraud)"; content:"|0b|babesloveit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baserich.com (SEO_Fraud)"; content:"|08|baserich|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bca-indo.com (Phishing_and_Theft)"; content:"|08|bca-indo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belleardene.com (SEO_Fraud)"; content:"|0b|belleardene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup berenicewillette.com (SEO_Fraud)"; content:"|10|berenicewillette|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bessiedania.com (SEO_Fraud)"; content:"|0b|bessiedania|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmeds4men.com (SEO_Fraud)"; content:"|0c|bestmeds4men|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betonyou.net (SEO_Fraud)"; content:"|08|betonyou|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betonyourselff.net (SEO_Fraud)"; content:"|0e|betonyourselff|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bgboihcwg.freetcp.com (Malware_Infectors)"; content:"|09|bgboihcwg|07|freetcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bibbiemalia.com (SEO_Fraud)"; content:"|0b|bibbiemalia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bjilse.net (Malware_Infectors)"; content:"|06|bjilse|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blamelessmanhood.com (SEO_Fraud)"; content:"|10|blamelessmanhood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blanchamarthe.com (SEO_Fraud)"; content:"|0d|blanchamarthe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blissejonibab.com (SEO_Fraud)"; content:"|0d|blissejonibab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bobbeecate.com (SEO_Fraud)"; content:"|0a|bobbeecate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup borobo3.com (Botnet_C&C)"; content:"|07|borobo3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxwatches.com (SEO_Fraud)"; content:"|0a|boxwatches|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup breenastephi.com (SEO_Fraud)"; content:"|0c|breenastephi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup briaanaliese.com (SEO_Fraud)"; content:"|0c|briaanaliese|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bridielinnell.com (SEO_Fraud)"; content:"|0d|bridielinnell|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brittegwendolyn.com (SEO_Fraud)"; content:"|0f|brittegwendolyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brittemufiivy.com (SEO_Fraud)"; content:"|0d|brittemufiivy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brittneybeljulee.com (SEO_Fraud)"; content:"|10|brittneybeljulee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brynnanadean.com (SEO_Fraud)"; content:"|0c|brynnanadean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buydrugs-online.com (SEO_Fraud)"; content:"|0f|buydrugs-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cancermedwelness.com (SEO_Fraud)"; content:"|10|cancermedwelness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caresaglennis.com (SEO_Fraud)"; content:"|0d|caresaglennis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carlottaardene.com (SEO_Fraud)"; content:"|0e|carlottaardene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caryeolande.com (SEO_Fraud)"; content:"|0b|caryeolande|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cathiletty.com (SEO_Fraud)"; content:"|0a|cathiletty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbcobxx.freetcp.com (Malware_Infectors)"; content:"|07|cbcobxx|07|freetcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccbill-online.com (Spyware)"; content:"|0d|ccbill-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cecileykrista.com (SEO_Fraud)"; content:"|0d|cecileykrista|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceilkathlin.com (SEO_Fraud)"; content:"|0b|ceilkathlin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celestafrancyne.com (SEO_Fraud)"; content:"|0f|celestafrancyne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup champinbed.com (SEO_Fraud)"; content:"|0a|champinbed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chargeyourlove.com (SEO_Fraud)"; content:"|0e|chargeyourlove|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cherimalorie.com (SEO_Fraud)"; content:"|0c|cherimalorie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheryophelia.com (SEO_Fraud)"; content:"|0c|cheryophelia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cilkaanallese.com (SEO_Fraud)"; content:"|0d|cilkaanallese|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cinemavip.net (Malware_Infectors)"; content:"|09|cinemavip|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleojessamine.com (SEO_Fraud)"; content:"|0d|cleojessamine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clorismay.com (SEO_Fraud)"; content:"|09|clorismay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corabelledollie.com (SEO_Fraud)"; content:"|0f|corabelledollie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corendashina.com (SEO_Fraud)"; content:"|0c|corendashina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpbnk.com (Phishing_and_Theft)"; content:"|05|cpbnk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuiwlixfs.zyns.com (Malware_Infectors)"; content:"|09|cuiwlixfs|04|zyns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup danitanicoline.com (SEO_Fraud)"; content:"|0e|danitanicoline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darcyvanessa.com (SEO_Fraud)"; content:"|0c|darcyvanessa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daunecarree.com (SEO_Fraud)"; content:"|0b|daunecarree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dayleronica.com (SEO_Fraud)"; content:"|0b|dayleronica|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dcialisforsale.com (SEO_Fraud)"; content:"|0e|dcialisforsale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dcialisforsale.net (SEO_Fraud)"; content:"|0e|dcialisforsale|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deberaysabel.com (SEO_Fraud)"; content:"|0c|deberaysabel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delorisjerrine.com (SEO_Fraud)"; content:"|0e|delorisjerrine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deniadela.com (SEO_Fraud)"; content:"|09|deniadela|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diandrajoeypat.com (SEO_Fraud)"; content:"|0e|diandrajoeypat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup didoyoshi.com (SEO_Fraud)"; content:"|09|didoyoshi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup disposedoingi.info (Malware_Distribution)"; content:"|0d|disposedoingi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup disposerespectfuli.info (Malware_Distribution)"; content:"|12|disposerespectfuli|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup disquietuderequiress.info (Malware_Distribution)"; content:"|14|disquietuderequiress|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dissolutecastlee.info (Malware_Distribution)"; content:"|10|dissolutecastlee|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doitforcrowler.com (Zeus_Zbot_SpyEye)"; content:"|0e|doitforcrowler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolljennifer.com (SEO_Fraud)"; content:"|0c|dolljennifer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donellecoralyn.com (SEO_Fraud)"; content:"|0e|donellecoralyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doralyndanya.com (SEO_Fraud)"; content:"|0c|doralyndanya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dream-payy.net (SEO_Fraud)"; content:"|0a|dream-payy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dreamboatnights.com (SEO_Fraud)"; content:"|0f|dreamboatnights|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugsmedicinebuy.com (SEO_Fraud)"; content:"|10|drugsmedicinebuy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dxcheck1.altervista.org (Malware_Infectors)"; content:"|08|dxcheck1|0a|altervista|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dxpzxtphlz.zyns.com (Malware_Infectors)"; content:"|0a|dxpzxtphlz|04|zyns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dxttypvx.ddns.info (Malware_Infectors)"; content:"|08|dxttypvx|04|ddns|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-onlinecialis.com (SEO_Fraud)"; content:"|0e|e-onlinecialis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-onlinecialis.net (SEO_Fraud)"; content:"|0e|e-onlinecialis|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-viagraonline.com (SEO_Fraud)"; content:"|0e|e-viagraonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-viagraonline.net (SEO_Fraud)"; content:"|0e|e-viagraonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edsurrenders.com (SEO_Fraud)"; content:"|0c|edsurrenders|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eglkeuxudy.freetcp.com (Malware_Infectors)"; content:"|0a|eglkeuxudy|07|freetcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elaneaudrey.com (SEO_Fraud)"; content:"|0b|elaneaudrey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elapsedvictoriousy.info (Malware_Distribution)"; content:"|12|elapsedvictoriousy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elapsewheree.info (Malware_Distribution)"; content:"|0c|elapsewheree|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elatedinactivityi.info (Malware_Distribution)"; content:"|11|elatedinactivityi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elmoexaminationi.info (Malware_Distribution)"; content:"|10|elmoexaminationi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elmofathera.info (Malware_Distribution)"; content:"|0b|elmofathera|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup embankmentsboilingo.info (Malware_Distribution)"; content:"|13|embankmentsboilingo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup embarkedlenti.info (Malware_Distribution)"; content:"|0d|embarkedlenti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup embassagejewelsd.info (Malware_Distribution)"; content:"|10|embassagejewelsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup embodiedseeminglyz.info (Malware_Distribution)"; content:"|12|embodiedseeminglyz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emilierosie.com (SEO_Fraud)"; content:"|0b|emilierosie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup employedgenerallys.info (Malware_Distribution)"; content:"|12|employedgenerallys|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup employment-channel.net (Malware_Distribution)"; content:"|12|employment-channel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup employment-reporter.net (Malware_Distribution)"; content:"|13|employment-reporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup employmentreporter.net (Malware_Distribution)"; content:"|12|employmentreporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup employmentswhereasl.info (Malware_Distribution)"; content:"|13|employmentswhereasl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emulationjoineds.info (Malware_Distribution)"; content:"|10|emulationjoineds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emulationpiez.info (Malware_Distribution)"; content:"|0d|emulationpiez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup encounterednoni.info (Malware_Distribution)"; content:"|0f|encounterednoni|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endeavoredmuscovitesa.info (Malware_Distribution)"; content:"|15|endeavoredmuscovitesa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endeavorloadingl.info (Malware_Distribution)"; content:"|10|endeavorloadingl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endurecommendationsd.info (Malware_Distribution)"; content:"|14|endurecommendationsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enduredsentencedl.info (Malware_Distribution)"; content:"|11|enduredsentencedl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup energyconceivedo.info (Malware_Distribution)"; content:"|10|energyconceivedo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup engageterritoriesd.info (Malware_Distribution)"; content:"|12|engageterritoriesd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup engineersdiscouraginga.info (Malware_Distribution)"; content:"|16|engineersdiscouraginga|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup engravingsstreetsy.info (Malware_Distribution)"; content:"|12|engravingsstreetsy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup engrossedboilingd.info (Malware_Distribution)"; content:"|11|engrossedboilingd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enhanceherpleasure.com (SEO_Fraud)"; content:"|12|enhanceherpleasure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enhancepotency.com (SEO_Fraud)"; content:"|0e|enhancepotency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enjoygloriousi.info (Malware_Distribution)"; content:"|0e|enjoygloriousi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enoprescription-cialis.com (SEO_Fraud)"; content:"|16|enoprescription-cialis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enoprescription-cialis.net (SEO_Fraud)"; content:"|16|enoprescription-cialis|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enoprescription-levitra.com (SEO_Fraud)"; content:"|17|enoprescription-levitra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enoprescription-levitra.net (SEO_Fraud)"; content:"|17|enoprescription-levitra|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enoprescription-viagra.com (SEO_Fraud)"; content:"|16|enoprescription-viagra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enoprescription-viagra.net (SEO_Fraud)"; content:"|16|enoprescription-viagra|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enricaclemmie.com (SEO_Fraud)"; content:"|0d|enricaclemmie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erikaines.com (SEO_Fraud)"; content:"|09|erikaines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erinalysia.com (SEO_Fraud)"; content:"|0a|erinalysia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esmecyndy.com (SEO_Fraud)"; content:"|09|esmecyndy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup essylouise.com (SEO_Fraud)"; content:"|0a|essylouise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estrellajulissa.com (SEO_Fraud)"; content:"|0f|estrellajulissa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eu43hkasss.com (Malware_Infectors)"; content:"|0a|eu43hkasss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eulamichelle.com (SEO_Fraud)"; content:"|0c|eulamichelle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evelinesimona.com (SEO_Fraud)"; content:"|0d|evelinesimona|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eviagra-super.com (SEO_Fraud)"; content:"|0d|eviagra-super|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eviagra-super.net (SEO_Fraud)"; content:"|0d|eviagra-super|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faunierobinet.com (SEO_Fraud)"; content:"|0d|faunierobinet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdpjwk.zyns.com (Malware_Infectors)"; content:"|06|fdpjwk|04|zyns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup felicdadjori.com (SEO_Fraud)"; content:"|0c|felicdadjori|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup felitafifi.com (SEO_Fraud)"; content:"|0a|felitafifi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fontsfornow.net (SEO_Fraud)"; content:"|0b|fontsfornow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forevervirile.com (SEO_Fraud)"; content:"|0d|forevervirile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foryourlovefeats.com (SEO_Fraud)"; content:"|10|foryourlovefeats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freehit.dyndns.org (Malware_Infectors)"; content:"|07|freehit|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftbradtvy.ddns.info (Malware_Infectors)"; content:"|09|ftbradtvy|04|ddns|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fullfreepoker.info (Zeus_Zbot_SpyEye)"; content:"|0d|fullfreepoker|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fzlqqq.cn (Malware_Infectors)"; content:"|06|fzlqqq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabeylucienne.com (SEO_Fraud)"; content:"|0d|gabeylucienne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getitstiff.com (SEO_Fraud)"; content:"|0a|getitstiff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gifhipx.freetcp.com (Malware_Infectors)"; content:"|07|gifhipx|07|freetcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ginevraaurilia.com (SEO_Fraud)"; content:"|0e|ginevraaurilia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godaddy-update.com (Malware_Distribution)"; content:"|0e|godaddy-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodbyelimpy.com (SEO_Fraud)"; content:"|0c|goodbyelimpy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goupopo.cn (Malware_Infectors)"; content:"|07|goupopo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guruluxury.com (SEO_Fraud)"; content:"|0a|guruluxury|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gusellashannon.com (SEO_Fraud)"; content:"|0e|gusellashannon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwendolenjonie.com (SEO_Fraud)"; content:"|0e|gwendolenjonie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwennethmeaghan.com (SEO_Fraud)"; content:"|0f|gwennethmeaghan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwennymarleah.com (SEO_Fraud)"; content:"|0d|gwennymarleah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwynletta.com (SEO_Fraud)"; content:"|09|gwynletta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hairplains.com (SEO_Fraud)"; content:"|0a|hairplains|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup halieroana.com (SEO_Fraud)"; content:"|0a|halieroana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup halimedacorly.com (SEO_Fraud)"; content:"|0d|halimedacorly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup halliejuliet.com (SEO_Fraud)"; content:"|0c|halliejuliet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardinasecond.com (SEO_Fraud)"; content:"|0d|hardinasecond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardnessrocks.com (SEO_Fraud)"; content:"|0d|hardnessrocks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardwhenneeded.com (SEO_Fraud)"; content:"|0e|hardwhenneeded|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harlifarrah.com (SEO_Fraud)"; content:"|0b|harlifarrah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harlipearline.com (SEO_Fraud)"; content:"|0d|harlipearline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harmoniewilly.com (SEO_Fraud)"; content:"|0d|harmoniewilly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harriatlanta.com (SEO_Fraud)"; content:"|0c|harriatlanta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harriemoreen.com (SEO_Fraud)"; content:"|0c|harriemoreen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harrietteaubry.com (SEO_Fraud)"; content:"|0e|harrietteaubry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harriettgusella.com (SEO_Fraud)"; content:"|0f|harriettgusella|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hattiejaquelin.com (SEO_Fraud)"; content:"|0e|hattiejaquelin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hattijacinda.com (SEO_Fraud)"; content:"|0c|hattijacinda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hedaannissa.com (SEO_Fraud)"; content:"|0b|hedaannissa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hedwiganorene.com (SEO_Fraud)"; content:"|0d|hedwiganorene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hedwiglexis.com (SEO_Fraud)"; content:"|0b|hedwiglexis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helainadoralynne.com (SEO_Fraud)"; content:"|10|helainadoralynne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellivina.com (SEO_Fraud)"; content:"|09|hellivina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hendrikaloni.com (SEO_Fraud)"; content:"|0c|hendrikaloni|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herminayalonda.com (SEO_Fraud)"; content:"|0e|herminayalonda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hertastephie.com (SEO_Fraud)"; content:"|0c|hertastephie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herthalisetta.com (SEO_Fraud)"; content:"|0d|herthalisetta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hkzonten.com (Malware_Infectors)"; content:"|08|hkzonten|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopeclarine.com (SEO_Fraud)"; content:"|0b|hopeclarine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hortensiacelene.com (SEO_Fraud)"; content:"|0f|hortensiacelene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howladieslikeit.com (SEO_Fraud)"; content:"|0f|howladieslikeit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqlkrsp.dns1.us (Malware_Infectors)"; content:"|07|hqlkrsp|04|dns1|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsgawtn.dns1.us (Malware_Infectors)"; content:"|07|hsgawtn|04|dns1|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugsnotslave.net (SEO_Fraud)"; content:"|0c|hugsnotslave|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyacintharegine.com (SEO_Fraud)"; content:"|0f|hyacintharegine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hydracock.ru (Zeus_Zbot_SpyEye)"; content:"|09|hydracock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idalinanickie.com (SEO_Fraud)"; content:"|0d|idalinanickie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilsecatrina.com (SEO_Fraud)"; content:"|0b|ilsecatrina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imbuecosmetics.com (SEO_Fraud)"; content:"|0e|imbuecosmetics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup impeccablevirility.com (SEO_Fraud)"; content:"|12|impeccablevirility|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup impotencefighter.com (SEO_Fraud)"; content:"|10|impotencefighter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup impotencesurrenders.com (SEO_Fraud)"; content:"|13|impotencesurrenders|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inaaubrey.com (SEO_Fraud)"; content:"|09|inaaubrey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inezermentrude.com (SEO_Fraud)"; content:"|0e|inezermentrude|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inezmadelaine.com (SEO_Fraud)"; content:"|0d|inezmadelaine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ingalise.com (SEO_Fraud)"; content:"|08|ingalise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iolanthedoroteya.com (SEO_Fraud)"; content:"|10|iolanthedoroteya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ironhardme.com (SEO_Fraud)"; content:"|0a|ironhardme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isabeauleandra.com (SEO_Fraud)"; content:"|0e|isabeauleandra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isabelhertha.com (SEO_Fraud)"; content:"|0c|isabelhertha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isidoraarlyne.com (SEO_Fraud)"; content:"|0d|isidoraarlyne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup issicolleen.com (SEO_Fraud)"; content:"|0b|issicolleen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup issieilla.com (SEO_Fraud)"; content:"|09|issieilla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivettclaudie.com (SEO_Fraud)"; content:"|0c|ivettclaudie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivoryjessamyn.com (SEO_Fraud)"; content:"|0d|ivoryjessamyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacklynbernie.com (SEO_Fraud)"; content:"|0d|jacklynbernie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacquelinbeatrisa.com (SEO_Fraud)"; content:"|11|jacquelinbeatrisa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacquiecammy.com (SEO_Fraud)"; content:"|0c|jacquiecammy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jeanniekarolina.com (SEO_Fraud)"; content:"|0f|jeanniekarolina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kepoe.info (Zeus_Zbot_SpyEye)"; content:"|05|kepoe|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjjjnj.net (Malware_Infectors)"; content:"|06|kjjjnj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kupc.no-ip.org (Malware_Infectors)"; content:"|04|kupc|05|no-ip|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ladiesmansshop.com (SEO_Fraud)"; content:"|0e|ladiesmansshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup layneykarylin.com (SEO_Fraud)"; content:"|0d|layneykarylin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lorenzasheba.com (SEO_Fraud)"; content:"|0c|lorenzasheba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovauxk.freetcp.com (Malware_Infectors)"; content:"|07|lovauxk|07|freetcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovelikechamp.com (SEO_Fraud)"; content:"|0d|lovelikechamp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovingallnite.com (SEO_Fraud)"; content:"|0d|lovingallnite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovingherright.com (SEO_Fraud)"; content:"|0e|lovingherright|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makeittnow.net (SEO_Fraud)"; content:"|0a|makeittnow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malemedications.com (SEO_Fraud)"; content:"|0f|malemedications|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup man4real.com (SEO_Fraud)"; content:"|08|man4real|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marrileebess.com (SEO_Fraud)"; content:"|0c|marrileebess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marvin9786.info (Malware_Infectors)"; content:"|0a|marvin9786|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meds4tonight.com (SEO_Fraud)"; content:"|0c|meds4tonight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup melosakirbee.com (SEO_Fraud)"; content:"|0c|melosakirbee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup menandmeds.com (SEO_Fraud)"; content:"|0a|menandmeds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mensfave.com (SEO_Fraud)"; content:"|08|mensfave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup menshelper.com (SEO_Fraud)"; content:"|0a|menshelper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mesohard.com (SEO_Fraud)"; content:"|08|mesohard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moje-wyprawy.net (Malware_Distribution)"; content:"|0c|moje-wyprawy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneyracing.ru (Spyware)"; content:"|0b|moneyracing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mrwrk.com (Spyware)"; content:"|05|mrwrk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musthaveformen.com (SEO_Fraud)"; content:"|0e|musthaveformen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myheathyerection.com (SEO_Fraud)"; content:"|10|myheathyerection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noelynjosey.com (SEO_Fraud)"; content:"|0b|noelynjosey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nqybitqzit.ddns.info (Malware_Infectors)"; content:"|0a|nqybitqzit|04|ddns|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nudyqq.zyns.com (Malware_Infectors)"; content:"|06|nudyqq|04|zyns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuzddhykyw.dns1.us (Malware_Infectors)"; content:"|0a|nuzddhykyw|04|dns1|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-drug-buy.com (SEO_Fraud)"; content:"|0f|online-drug-buy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineonline-streams.info (Malware_Infectors)"; content:"|14|onlineonline-streams|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinepillsbuy.com (SEO_Fraud)"; content:"|0e|onlinepillsbuy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinestore-soft.com (SEO_Fraud)"; content:"|10|onlinestore-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onuraltintas.com (Malware_Infectors)"; content:"|0c|onuraltintas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opwqmm.net (Malware_Infectors)"; content:"|06|opwqmm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oqgxxbgl.ddns.info (Malware_Infectors)"; content:"|08|oqgxxbgl|04|ddns|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oxsamlg.ddns.info (Malware_Infectors)"; content:"|07|oxsamlg|04|ddns|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paybycardonline.com (Spyware)"; content:"|0f|paybycardonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfectallnightlong.com (SEO_Fraud)"; content:"|13|perfectallnightlong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfecthardness.com (SEO_Fraud)"; content:"|0f|perfecthardness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfectvirility.com (SEO_Fraud)"; content:"|0f|perfectvirility|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pill-online-store.com (SEO_Fraud)"; content:"|11|pill-online-store|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pleasethatlady.com (SEO_Fraud)"; content:"|0e|pleasethatlady|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proudofhardness.com (SEO_Fraud)"; content:"|0f|proudofhardness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rayshelllela.com (SEO_Fraud)"; content:"|0c|rayshelllela|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realmanshelper.com (SEO_Fraud)"; content:"|0e|realmanshelper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realpleaser.com (SEO_Fraud)"; content:"|0b|realpleaser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restlesslover.com (SEO_Fraud)"; content:"|0d|restlesslover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roselineshena.com (SEO_Fraud)"; content:"|0d|roselineshena|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rs933tl4.rapidshare.com (Malware_Infectors)"; content:"|08|rs933tl4|0a|rapidshare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rss.openpicz.net (Malware_Infectors)"; content:"|03|rss|08|openpicz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sallieulrica.com (SEO_Fraud)"; content:"|0c|sallieulrica|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sandynara.sites.uol.com.br (Malware_Infectors)"; content:"|09|sandynara|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2653999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup satisfyanylady.com (SEO_Fraud)"; content:"|0e|satisfyanylady|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup satisfyhertonight.com (SEO_Fraud)"; content:"|11|satisfyhertonight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbuying-cialis.com (SEO_Fraud)"; content:"|0e|sbuying-cialis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbuying-cialis.net (SEO_Fraud)"; content:"|0e|sbuying-cialis|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbuying-levitra.com (SEO_Fraud)"; content:"|0f|sbuying-levitra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbuying-levitra.net (SEO_Fraud)"; content:"|0f|sbuying-levitra|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbuying-viagra.com (SEO_Fraud)"; content:"|0e|sbuying-viagra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbuying-viagra.net (SEO_Fraud)"; content:"|0e|sbuying-viagra|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdoqds.net (Malware_Infectors)"; content:"|06|sdoqds|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shelbacelie.com (SEO_Fraud)"; content:"|0b|shelbacelie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shesgonnaloveit.com (SEO_Fraud)"; content:"|0f|shesgonnaloveit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shirleencelesta.com (SEO_Fraud)"; content:"|0f|shirleencelesta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop-your.com (SEO_Fraud)"; content:"|09|shop-your|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shy4thgi2.com (Malware_Infectors)"; content:"|09|shy4thgi2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shzykths.com (Malware_Infectors)"; content:"|08|shzykths|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stallioninyou.com (SEO_Fraud)"; content:"|0d|stallioninyou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stifferandstiffer.com (SEO_Fraud)"; content:"|11|stifferandstiffer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuffluxury.com (SEO_Fraud)"; content:"|0b|stuffluxury|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suisaoy4ghj.com (Malware_Infectors)"; content:"|0b|suisaoy4ghj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susjyyehjskjseh.com (Malware_Infectors)"; content:"|0f|susjyyehjskjseh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syiueyhwelwb.com (Malware_Infectors)"; content:"|0c|syiueyhwelwb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup takeovered.com (SEO_Fraud)"; content:"|0a|takeovered|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tandiegwen.com (SEO_Fraud)"; content:"|0a|tandiegwen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tetroli.be (Malware_Infectors)"; content:"|07|tetroli|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theedfighters.com (SEO_Fraud)"; content:"|0d|theedfighters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themensremedy.com (SEO_Fraud)"; content:"|0d|themensremedy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup therealpleaser.com (SEO_Fraud)"; content:"|0e|therealpleaser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thestiffener.com (SEO_Fraud)"; content:"|0c|thestiffener|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toecurlinghardness.com (SEO_Fraud)"; content:"|12|toecurlinghardness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tovail.be (Malware_Infectors)"; content:"|06|tovail|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truevirility.com (SEO_Fraud)"; content:"|0c|truevirility|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyuwygskjgk.com (Malware_Infectors)"; content:"|0b|tyuwygskjgk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubagroupsplc.net (Phishing_and_Theft)"; content:"|0c|ubagroupsplc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujggfqaeh.zyns.com (Malware_Infectors)"; content:"|09|ujggfqaeh|04|zyns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup untiringnews.net (SEO_Fraud)"; content:"|0c|untiringnews|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upstracks.net (Malware_Infectors)"; content:"|09|upstracks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upstracks.org (Malware_Infectors)"; content:"|09|upstracks|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup useyourunit.com (SEO_Fraud)"; content:"|0b|useyourunit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v22script.altervista.org (Malware_Infectors)"; content:"|09|v22script|0a|altervista|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virilityinsurance.com (SEO_Fraud)"; content:"|11|virilityinsurance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w6x6.com (Malware_Infectors)"; content:"|04|w6x6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wantedhyladies.com (SEO_Fraud)"; content:"|0e|wantedhyladies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watcheco.com (SEO_Fraud)"; content:"|08|watcheco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wayluxury.com (SEO_Fraud)"; content:"|09|wayluxury|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weraty.biz (Zeus_Zbot_SpyEye)"; content:"|06|weraty|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wzhcdyeea.dns1.us (Malware_Infectors)"; content:"|09|wzhcdyeea|04|dns1|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xoophafiel.ru (Malware_Distribution)"; content:"|0a|xoophafiel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xz26.com (Malware_Infectors)"; content:"|04|xz26|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xz49.com (Malware_Infectors)"; content:"|04|xz49|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahtzee.hostmonarchy.com (Malware_Infectors)"; content:"|07|yahtzee|0c|hostmonarchy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourdreamspay.net (SEO_Fraud)"; content:"|0d|yourdreamspay|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourloveenergy.com (SEO_Fraud)"; content:"|0e|yourloveenergy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youtubestudiopro.com (Spyware)"; content:"|10|youtubestudiopro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yubwwzfmk.freetcp.com (Malware_Infectors)"; content:"|09|yubwwzfmk|07|freetcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yxraqxbgvy.dns1.us (Malware_Infectors)"; content:"|0a|yxraqxbgvy|04|dns1|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zfnn.net (SEO_Fraud)"; content:"|04|zfnn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zonelux.com (SEO_Fraud)"; content:"|07|zonelux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pulpic.com (Malware_Infectors)"; content:"|06|pulpic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2651129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaqam.ru (SEO_Fraud)"; content:"|05|aaqam|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activationcode.ru (Malware_Distribution)"; content:"|0e|activationcode|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actpub.ru (SEO_Fraud)"; content:"|06|actpub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actyak.ru (SEO_Fraud)"; content:"|06|actyak|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup airaxe.ru (SEO_Fraud)"; content:"|06|airaxe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alepad.ru (SEO_Fraud)"; content:"|06|alepad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ampale.ru (SEO_Fraud)"; content:"|06|ampale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ampwax.ru (SEO_Fraud)"; content:"|06|ampwax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ampyou.ru (SEO_Fraud)"; content:"|06|ampyou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aonqrnernvqret.net (Botnet_C&C)"; content:"|0e|aonqrnernvqret|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armcar.ru (SEO_Fraud)"; content:"|06|armcar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baggum.ru (SEO_Fraud)"; content:"|06|baggum|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bagmug.ru (SEO_Fraud)"; content:"|06|bagmug|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barham.ru (SEO_Fraud)"; content:"|06|barham|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bartar.ru (SEO_Fraud)"; content:"|06|bartar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup batear.ru (SEO_Fraud)"; content:"|06|batear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup batray.ru (SEO_Fraud)"; content:"|06|batray|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedmic.ru (SEO_Fraud)"; content:"|06|bedmic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedsky.ru (SEO_Fraud)"; content:"|06|bedsky|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup binday.ru (SEO_Fraud)"; content:"|06|binday|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup binsax.ru (SEO_Fraud)"; content:"|06|binsax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitice.ru (SEO_Fraud)"; content:"|06|bitice|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitsea.ru (SEO_Fraud)"; content:"|06|bitsea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bktpm.ru (SEO_Fraud)"; content:"|05|bktpm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boggas.ru (SEO_Fraud)"; content:"|06|boggas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bogzoo.ru (SEO_Fraud)"; content:"|06|bogzoo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxfad.ru (SEO_Fraud)"; content:"|06|boxfad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxlid.ru (SEO_Fraud)"; content:"|06|boxlid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boybug.ru (SEO_Fraud)"; content:"|06|boybug|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brzvw.ru (SEO_Fraud)"; content:"|05|brzvw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bungut.ru (SEO_Fraud)"; content:"|06|bungut|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunsum.ru (SEO_Fraud)"; content:"|06|bunsum|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canmob.ru (SEO_Fraud)"; content:"|06|canmob|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cansax.ru (SEO_Fraud)"; content:"|06|cansax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cartea.ru (SEO_Fraud)"; content:"|06|cartea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catcan.ru (SEO_Fraud)"; content:"|06|catcan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catego.ru (SEO_Fraud)"; content:"|06|catego|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catwit.ru (SEO_Fraud)"; content:"|06|catwit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cowelf.ru (SEO_Fraud)"; content:"|06|cowelf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cowfox.ru (SEO_Fraud)"; content:"|06|cowfox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cowlid.ru (SEO_Fraud)"; content:"|06|cowlid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cowzit.ru (SEO_Fraud)"; content:"|06|cowzit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupact.ru (SEO_Fraud)"; content:"|06|cupact|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuparm.ru (SEO_Fraud)"; content:"|06|cuparm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupbun.ru (SEO_Fraud)"; content:"|06|cupbun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupgin.ru (SEO_Fraud)"; content:"|06|cupgin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupsun.ru (SEO_Fraud)"; content:"|06|cupsun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dadnet.ru (SEO_Fraud)"; content:"|06|dadnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dewjar.ru (SEO_Fraud)"; content:"|06|dewjar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dogpen.ru (SEO_Fraud)"; content:"|06|dogpen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotbog.ru (SEO_Fraud)"; content:"|06|dotbog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloads-field.co.cc (Malware_Distribution)"; content:"|0f|downloads-field|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugtoreprescriptionmedspharmacy.ru (SEO_Fraud)"; content:"|20|drugtoreprescriptionmedspharmacy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugtoretabletspillsgroup.com (SEO_Fraud)"; content:"|19|drugtoretabletspillsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dyebat.ru (SEO_Fraud)"; content:"|06|dyebat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dyecup.ru (SEO_Fraud)"; content:"|06|dyecup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dyerim.ru (SEO_Fraud)"; content:"|06|dyerim|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earham.ru (SEO_Fraud)"; content:"|06|earham|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earleg.ru (SEO_Fraud)"; content:"|06|earleg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eepeohothe.ru (SEO_Fraud)"; content:"|0a|eepeohothe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eggant.ru (SEO_Fraud)"; content:"|06|eggant|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eggbed.ru (SEO_Fraud)"; content:"|06|eggbed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egoarm.ru (SEO_Fraud)"; content:"|06|egoarm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egoaxe.ru (SEO_Fraud)"; content:"|06|egoaxe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egomud.ru (SEO_Fraud)"; content:"|06|egomud|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ejjeh.ru (SEO_Fraud)"; content:"|05|ejjeh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekfisymvef.com (SEO_Fraud)"; content:"|0a|ekfisymvef|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elfbay.ru (SEO_Fraud)"; content:"|06|elfbay|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eoppmomuklsrxqor.info (Botnet_C&C)"; content:"|10|eoppmomuklsrxqor|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyekey.ru (SEO_Fraud)"; content:"|06|eyekey|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyerib.ru (SEO_Fraud)"; content:"|06|eyerib|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fabia-art.com (Phishing_and_Theft)"; content:"|09|fabia-art|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fadbun.ru (SEO_Fraud)"; content:"|06|fadbun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fadmug.ru (SEO_Fraud)"; content:"|06|fadmug|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fadoil.ru (SEO_Fraud)"; content:"|06|fadoil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanice.ru (SEO_Fraud)"; content:"|06|fanice|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanmen.ru (SEO_Fraud)"; content:"|06|fanmen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanpot.ru (SEO_Fraud)"; content:"|06|fanpot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feocr.ru (SEO_Fraud)"; content:"|05|feocr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffvig.ru (SEO_Fraud)"; content:"|05|ffvig|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fine-artgroup.com (Phishing_and_Theft)"; content:"|0d|fine-artgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forexinvestorservice.com (Malware_Distribution)"; content:"|14|forexinvestorservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxale.ru (SEO_Fraud)"; content:"|06|foxale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxrim.ru (SEO_Fraud)"; content:"|06|foxrim|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxzit.ru (SEO_Fraud)"; content:"|06|foxzit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frcfir.com ()"; content:"|06|frcfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frirmfqtmsdpkkwr.info (Botnet_C&C)"; content:"|10|frirmfqtmsdpkkwr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frwmy.ru (SEO_Fraud)"; content:"|05|frwmy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fungin.ru (SEO_Fraud)"; content:"|06|fungin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galhog.ru (SEO_Fraud)"; content:"|06|galhog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galmom.ru (SEO_Fraud)"; content:"|06|galmom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gapsky.ru (SEO_Fraud)"; content:"|06|gapsky|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gapzoo.ru (SEO_Fraud)"; content:"|06|gapzoo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaspan.ru (SEO_Fraud)"; content:"|06|gaspan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ginmap.ru (SEO_Fraud)"; content:"|06|ginmap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldmail.in (Malware_Distribution)"; content:"|08|goldmail|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gpnwo.ru (SEO_Fraud)"; content:"|05|gpnwo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grimenviper.pochta.ru (Malware_Distribution)"; content:"|0b|grimenviper|06|pochta|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumdad.ru (SEO_Fraud)"; content:"|06|gumdad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumpen.ru (SEO_Fraud)"; content:"|06|gumpen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumtub.ru (SEO_Fraud)"; content:"|06|gumtub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gunbog.ru (SEO_Fraud)"; content:"|06|gunbog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gunyou.ru (SEO_Fraud)"; content:"|06|gunyou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gutegg.ru (SEO_Fraud)"; content:"|06|gutegg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gutrow.ru (SEO_Fraud)"; content:"|06|gutrow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gutyou.ru (SEO_Fraud)"; content:"|06|gutyou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guybot.ru (SEO_Fraud)"; content:"|06|guybot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guyfox.ru (SEO_Fraud)"; content:"|06|guyfox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guypal.ru (SEO_Fraud)"; content:"|06|guypal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guytip.ru (SEO_Fraud)"; content:"|06|guytip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hambag.ru (SEO_Fraud)"; content:"|06|hambag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harderthanever.com (SEO_Fraud)"; content:"|0e|harderthanever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hatyak.ru (SEO_Fraud)"; content:"|06|hatyak|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdogm.ru (SEO_Fraud)"; content:"|05|hdogm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herbalpilldrug.com (SEO_Fraud)"; content:"|0e|herbalpilldrug|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herbalpillsgroup.com (SEO_Fraud)"; content:"|10|herbalpillsgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herbalpillwine.com (SEO_Fraud)"; content:"|0e|herbalpillwine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hidpharmacy.com (SEO_Fraud)"; content:"|0b|hidpharmacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup higzasri.com (SEO_Fraud)"; content:"|08|higzasri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitink.ru (SEO_Fraud)"; content:"|06|hitink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hmopharmacyrx.com (SEO_Fraud)"; content:"|0d|hmopharmacyrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hodjoqumi.com (SEO_Fraud)"; content:"|09|hodjoqumi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hogant.ru (SEO_Fraud)"; content:"|06|hogant|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hogelf.ru (SEO_Fraud)"; content:"|06|hogelf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hospitalmedic.net (SEO_Fraud)"; content:"|0d|hospitalmedic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huxweppeix.com (SEO_Fraud)"; content:"|0a|huxweppeix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icebergsrx.com (SEO_Fraud)"; content:"|0a|icebergsrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icemum.ru (SEO_Fraud)"; content:"|06|icemum|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icepot.ru (SEO_Fraud)"; content:"|06|icepot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idbxa.ru (SEO_Fraud)"; content:"|05|idbxa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iftvolzclmstnvk.net (Botnet_C&C)"; content:"|0f|iftvolzclmstnvk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inkair.ru (SEO_Fraud)"; content:"|06|inkair|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inkoil.ru (SEO_Fraud)"; content:"|06|inkoil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insurancehealthdrugstore.com (SEO_Fraud)"; content:"|18|insurancehealthdrugstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iondye.ru (SEO_Fraud)"; content:"|06|iondye|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iongap.ru (SEO_Fraud)"; content:"|06|iongap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ionwax.ru (SEO_Fraud)"; content:"|06|ionwax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ionyak.ru (SEO_Fraud)"; content:"|06|ionyak|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipsma.ru (SEO_Fraud)"; content:"|05|ipsma|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irorfstlnvtpl.com (Botnet_C&C)"; content:"|0d|irorfstlnvtpl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixfiedyck.com (SEO_Fraud)"; content:"|09|ixfiedyck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jakfw.ru (SEO_Fraud)"; content:"|05|jakfw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jarboy.ru (SEO_Fraud)"; content:"|06|jarboy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jarkey.ru (SEO_Fraud)"; content:"|06|jarkey|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jarsky.ru (SEO_Fraud)"; content:"|06|jarsky|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jblii.ru (SEO_Fraud)"; content:"|05|jblii|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhiye.ru (SEO_Fraud)"; content:"|05|jhiye|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jidmoemgow.com (SEO_Fraud)"; content:"|0a|jidmoemgow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jiokfayrov.com (SEO_Fraud)"; content:"|0a|jiokfayrov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jmwbr.ru (SEO_Fraud)"; content:"|05|jmwbr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup judryefzu.com (SEO_Fraud)"; content:"|09|judryefzu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup julpillstablets.com (SEO_Fraud)"; content:"|0f|julpillstablets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jvzogtyoqnxknktw.org (Botnet_C&C)"; content:"|10|jvzogtyoqnxknktw|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keydad.ru (SEO_Fraud)"; content:"|06|keydad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keyrim.ru (SEO_Fraud)"; content:"|06|keyrim|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kfpjtqslcybrtglt.biz (Botnet_C&C)"; content:"|10|kfpjtqslcybrtglt|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kidegg.ru (SEO_Fraud)"; content:"|06|kidegg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kidmap.ru (SEO_Fraud)"; content:"|06|kidmap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kidmic.ru (SEO_Fraud)"; content:"|06|kidmic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kidpeg.ru (SEO_Fraud)"; content:"|06|kidpeg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiropraktoren.eu (Malware_Distribution)"; content:"|0d|kiropraktoren|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kveghynyzi.com (SEO_Fraud)"; content:"|0a|kveghynyzi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labdot.ru (SEO_Fraud)"; content:"|06|labdot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labpeg.ru (SEO_Fraud)"; content:"|06|labpeg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llaptops.co.cc (Malware_Distribution)"; content:"|08|llaptops|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lookasaudio.com (Malware_Distribution)"; content:"|0b|lookasaudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lrfsluzwfqmnpqg.biz (Botnet_C&C)"; content:"|0f|lrfsluzwfqmnpqg|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ltd-scg.net (Phishing_and_Theft)"; content:"|07|ltd-scg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lwkqptqvmltifdxb.info (Botnet_C&C)"; content:"|10|lwkqptqvmltifdxb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malemedz.com (SEO_Fraud)"; content:"|08|malemedz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matreshka5.cx.cc (Malware_Distribution)"; content:"|0a|matreshka5|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicalpharmgroup.com (SEO_Fraud)"; content:"|11|medicalpharmgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medichealthprescription.ru (SEO_Fraud)"; content:"|17|medichealthprescription|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medsdrugstorepills.ru (SEO_Fraud)"; content:"|12|medsdrugstorepills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medspillspharmacygulf.net (SEO_Fraud)"; content:"|15|medspillspharmacygulf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup menspharmaceuticals.com (SEO_Fraud)"; content:"|13|menspharmaceuticals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup menssaviors.com (SEO_Fraud)"; content:"|0b|menssaviors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mkqoblovjuntepd.biz (Botnet_C&C)"; content:"|0f|mkqoblovjuntepd|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtufnrjuplvgxmz.info (Botnet_C&C)"; content:"|0f|mtufnrjuplvgxmz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mvtnd.ru (SEO_Fraud)"; content:"|05|mvtnd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ngbrrspsmkkjiqor.com (Botnet_C&C)"; content:"|10|ngbrrspsmkkjiqor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nkqkhzlvdsmxxmmf.net (Botnet_C&C)"; content:"|10|nkqkhzlvdsmxxmmf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntpkysoqfpxnszn.info (Botnet_C&C)"; content:"|0f|ntpkysoqfpxnszn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nzqdnnkntsrjcn.info (Botnet_C&C)"; content:"|0e|nzqdnnkntsrjcn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ocbyrpigo.net (SEO_Fraud)"; content:"|09|ocbyrpigo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odnynjiwxqkiqda.biz (Botnet_C&C)"; content:"|0f|odnynjiwxqkiqda|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogff.ru (SEO_Fraud)"; content:"|04|ogff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outqrpskulndkxne.info (Botnet_C&C)"; content:"|10|outqrpskulndkxne|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panart-llc.com (Phishing_and_Theft)"; content:"|0a|panart-llc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmacybuyprescription.ru (SEO_Fraud)"; content:"|17|pharmacybuyprescription|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmacydrugsite.ru (SEO_Fraud)"; content:"|10|pharmacydrugsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmacyfitnessdrugstore.ru (SEO_Fraud)"; content:"|18|pharmacyfitnessdrugstore|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmacymedsrx.ru (SEO_Fraud)"; content:"|0e|pharmacymedsrx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmatabs.net (SEO_Fraud)"; content:"|0a|pharmatabs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phgrifol.com (SEO_Fraud)"; content:"|08|phgrifol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsdrugstoremedicare.net (SEO_Fraud)"; content:"|16|pillsdrugstoremedicare|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsmedicare.com (SEO_Fraud)"; content:"|0d|pillsmedicare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pimfvworqtkvnhm.net (Botnet_C&C)"; content:"|0f|pimfvworqtkvnhm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pitneafs.com (SEO_Fraud)"; content:"|08|pitneafs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poropaxqulh.com (SEO_Fraud)"; content:"|0b|poropaxqulh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pronounceimportancet.info (Malware_Distribution)"; content:"|14|pronounceimportancet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pronouncingoffendl.info (Malware_Distribution)"; content:"|12|pronouncingoffendl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proposedbei.info (Malware_Distribution)"; content:"|0b|proposedbei|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proposeofficery.info (Malware_Distribution)"; content:"|0f|proposeofficery|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prosperedpresumptuouslys.info (Malware_Distribution)"; content:"|18|prosperedpresumptuouslys|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prosperouslydeclinings.info (Malware_Distribution)"; content:"|16|prosperouslydeclinings|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prostratecontemplateda.info (Malware_Distribution)"; content:"|16|prostratecontemplateda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protestantchancel.info (Malware_Distribution)"; content:"|11|protestantchancel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protestantirons.info (Malware_Distribution)"; content:"|0f|protestantirons|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protestappointmenti.info (Malware_Distribution)"; content:"|13|protestappointmenti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup provincebando.info (Malware_Distribution)"; content:"|0d|provincebando|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pruthprimed.info (Malware_Distribution)"; content:"|0b|pruthprimed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psznjjhwsetknen.net (Botnet_C&C)"; content:"|0f|psznjjhwsetknen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pullinginquiryl.info (Malware_Distribution)"; content:"|0f|pullinginquiryl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwixcoah.com (SEO_Fraud)"; content:"|08|qwixcoah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwordiquy.com (SEO_Fraud)"; content:"|09|qwordiquy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qxosridseyfnujl.org (Botnet_C&C)"; content:"|0f|qxosridseyfnujl|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ratsed.com (SEO_Fraud)"; content:"|06|ratsed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readforty.info (Malware_Distribution)"; content:"|09|readforty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readinessagesl.info (Malware_Distribution)"; content:"|0e|readinessagesl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readinesscapo.info (Malware_Distribution)"; content:"|0d|readinesscapo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readinessmovedy.info (Malware_Distribution)"; content:"|0f|readinessmovedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reaispharmacyrx.com (SEO_Fraud)"; content:"|0f|reaispharmacyrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recedjyw.com (SEO_Fraud)"; content:"|08|recedjyw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reclaimwez.info (Malware_Distribution)"; content:"|0a|reclaimwez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recollectkeepy.info (Malware_Distribution)"; content:"|0e|recollectkeepy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reconciliationinterruptt.info (Malware_Distribution)"; content:"|18|reconciliationinterruptt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recruiting-reporter.net (Malware_Distribution)"; content:"|13|recruiting-reporter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redressreporteda.info (Malware_Distribution)"; content:"|10|redressreporteda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reformingpassingi.info (Malware_Distribution)"; content:"|11|reformingpassingi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regularauthenticateda.info (Malware_Distribution)"; content:"|15|regularauthenticateda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reignscivilizations.info (Malware_Distribution)"; content:"|13|reignscivilizations|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rejoindergarmenti.info (Malware_Distribution)"; content:"|11|rejoindergarmenti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relianceheroismt.info (Malware_Distribution)"; content:"|10|relianceheroismt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup religioncompletingd.info (Malware_Distribution)"; content:"|13|religioncompletingd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remedyformen.com (SEO_Fraud)"; content:"|0c|remedyformen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup renderassembles.info (Malware_Distribution)"; content:"|0f|renderassembles|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reposesightedd.info (Malware_Distribution)"; content:"|0e|reposesightedd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rizvs.ru (SEO_Fraud)"; content:"|05|rizvs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rowmap.ru (SEO_Fraud)"; content:"|06|rowmap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rquwopkohukniuj.info (Botnet_C&C)"; content:"|0f|rquwopkohukniuj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruear.ru (SEO_Fraud)"; content:"|05|ruear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxdietpillsmeds.ru (SEO_Fraud)"; content:"|0f|rxdietpillsmeds|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxhealthcarepatients.com (SEO_Fraud)"; content:"|14|rxhealthcarepatients|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxmedsmedical.ru (SEO_Fraud)"; content:"|0d|rxmedsmedical|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxeye.ru (SEO_Fraud)"; content:"|06|saxeye|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxink.ru (SEO_Fraud)"; content:"|06|saxink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seagum.ru (SEO_Fraud)"; content:"|06|seagum|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skysum.ru (SEO_Fraud)"; content:"|06|skysum|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slkruqfprnkjhm.net (Botnet_C&C)"; content:"|0e|slkruqfprnkjhm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sodjar.ru (SEO_Fraud)"; content:"|06|sodjar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sodtea.ru (SEO_Fraud)"; content:"|06|sodtea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somaliamedicinetablet.com (SEO_Fraud)"; content:"|15|somaliamedicinetablet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somnoigra.com (SEO_Fraud)"; content:"|09|somnoigra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonbar.ru (SEO_Fraud)"; content:"|06|sonbar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonhog.ru (SEO_Fraud)"; content:"|06|sonhog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonmat.ru (SEO_Fraud)"; content:"|06|sonmat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sontax.ru (SEO_Fraud)"; content:"|06|sontax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sontea.ru (SEO_Fraud)"; content:"|06|sontea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spalid.ru (SEO_Fraud)"; content:"|06|spalid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stiffasstone.com (SEO_Fraud)"; content:"|0c|stiffasstone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumbus.ru (SEO_Fraud)"; content:"|06|sumbus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumpad.ru (SEO_Fraud)"; content:"|06|sumpad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumsod.ru (SEO_Fraud)"; content:"|06|sumsod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabdiet.com (SEO_Fraud)"; content:"|07|tabdiet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletcare2.com (SEO_Fraud)"; content:"|0b|tabletcare2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletdrugsurya.com (SEO_Fraud)"; content:"|0f|tabletdrugsurya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletherbal.com (SEO_Fraud)"; content:"|0c|tabletherbal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletmedsrxteam.net (SEO_Fraud)"; content:"|10|tabletmedsrxteam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletpharmacydrug.com (SEO_Fraud)"; content:"|12|tabletpharmacydrug|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletpharmacypillsworld.net (SEO_Fraud)"; content:"|18|tabletpharmacypillsworld|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletscarepharmacy.com (SEO_Fraud)"; content:"|13|tabletscarepharmacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletsdrugstoredrugs.net (SEO_Fraud)"; content:"|15|tabletsdrugstoredrugs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletsdrugstorefitness.com (SEO_Fraud)"; content:"|17|tabletsdrugstorefitness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletspharmacyrx.com (SEO_Fraud)"; content:"|11|tabletspharmacyrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletsprecisionpharmacyrx.com (SEO_Fraud)"; content:"|1a|tabletsprecisionpharmacyrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletsrx.ru (SEO_Fraud)"; content:"|09|tabletsrx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabletsrxdrugstore.ru (SEO_Fraud)"; content:"|12|tabletsrxdrugstore|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tablip.ru (SEO_Fraud)"; content:"|06|tablip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabmedicare.com (SEO_Fraud)"; content:"|0b|tabmedicare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabpet.ru (SEO_Fraud)"; content:"|06|tabpet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabpit.ru (SEO_Fraud)"; content:"|06|tabpit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagfad.ru (SEO_Fraud)"; content:"|06|tagfad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taghog.ru (SEO_Fraud)"; content:"|06|taghog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tapnet.ru (SEO_Fraud)"; content:"|06|tapnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tapute.ru (SEO_Fraud)"; content:"|06|tapute|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tarlid.ru (SEO_Fraud)"; content:"|06|tarlid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxbug.ru (SEO_Fraud)"; content:"|06|taxbug|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxoil.ru (SEO_Fraud)"; content:"|06|taxoil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teaamp.ru (SEO_Fraud)"; content:"|06|teaamp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teakid.ru (SEO_Fraud)"; content:"|06|teakid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teapad.ru (SEO_Fraud)"; content:"|06|teapad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup techce-group.com (Phishing_and_Theft)"; content:"|0c|techce-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tieion.ru (SEO_Fraud)"; content:"|06|tieion|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tintap.ru (SEO_Fraud)"; content:"|06|tintap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tipcan.ru (SEO_Fraud)"; content:"|06|tipcan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tipray.ru (SEO_Fraud)"; content:"|06|tipray|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tixsqadkmslsdvwi.com (Botnet_C&C)"; content:"|10|tixsqadkmslsdvwi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toefan.ru (SEO_Fraud)"; content:"|06|toefan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tqqhzkpureytrfa.info (Botnet_C&C)"; content:"|0f|tqqhzkpureytrfa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup triad-webs.com (Phishing_and_Theft)"; content:"|0a|triad-webs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trippharmacypharmacy.net (SEO_Fraud)"; content:"|14|trippharmacypharmacy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubbus.ru (SEO_Fraud)"; content:"|06|tubbus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubspa.ru (SEO_Fraud)"; content:"|06|tubspa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubwax.ru (SEO_Fraud)"; content:"|06|tubwax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uiinwznjvpotnsq.biz (Botnet_C&C)"; content:"|0f|uiinwznjvpotnsq|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utedew.ru (SEO_Fraud)"; content:"|06|utedew|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uteelf.ru (SEO_Fraud)"; content:"|06|uteelf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utepub.ru (SEO_Fraud)"; content:"|06|utepub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utstqtqicqaabuk.biz (Botnet_C&C)"; content:"|0f|utstqtqicqaabuk|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uwpkx.ru (SEO_Fraud)"; content:"|05|uwpkx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vailherdo.com (SEO_Fraud)"; content:"|09|vailherdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vfutwpmeuiqvrix.org (Botnet_C&C)"; content:"|0f|vfutwpmeuiqvrix|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vjopwmfmqulkvosi.org (Botnet_C&C)"; content:"|10|vjopwmfmqulkvosi|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vjulnlgoqlzpt.info (Botnet_C&C)"; content:"|0d|vjulnlgoqlzpt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkashy.tk (Malware_Distribution)"; content:"|06|vkashy|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkyotqukix.com (SEO_Fraud)"; content:"|0a|vkyotqukix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vufrdmytqprvisum.info (Botnet_C&C)"; content:"|10|vufrdmytqprvisum|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wartag.ru (SEO_Fraud)"; content:"|06|wartag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waxdog.ru (SEO_Fraud)"; content:"|06|waxdog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waxmix.ru (SEO_Fraud)"; content:"|06|waxmix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waxpot.ru (SEO_Fraud)"; content:"|06|waxpot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webgap.ru (SEO_Fraud)"; content:"|06|webgap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whxymmmhdsgxmumm.com (Botnet_C&C)"; content:"|10|whxymmmhdsgxmumm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wigme.ru (SEO_Fraud)"; content:"|05|wigme|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup witink.ru (SEO_Fraud)"; content:"|06|witink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wittax.ru (SEO_Fraud)"; content:"|06|wittax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xqfom.ru (SEO_Fraud)"; content:"|05|xqfom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xqkjv.ru (SEO_Fraud)"; content:"|05|xqkjv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xqoyjkmnrhqmxpty.net (Botnet_C&C)"; content:"|10|xqoyjkmnrhqmxpty|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xsnnsynlsnfhklun.com (Botnet_C&C)"; content:"|10|xsnnsynlsnfhklun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyndi.ru (SEO_Fraud)"; content:"|05|xyndi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yakmix.ru (SEO_Fraud)"; content:"|06|yakmix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yakpal.ru (SEO_Fraud)"; content:"|06|yakpal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yakpen.ru (SEO_Fraud)"; content:"|06|yakpen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ylsvuiyoufocowpn.org (Botnet_C&C)"; content:"|10|ylsvuiyoufocowpn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youlaw.ru (SEO_Fraud)"; content:"|06|youlaw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youmud.ru (SEO_Fraud)"; content:"|06|youmud|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zdvbv.ru (SEO_Fraud)"; content:"|05|zdvbv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zgswi.ru (SEO_Fraud)"; content:"|05|zgswi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zitegg.ru (SEO_Fraud)"; content:"|06|zitegg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zitpaw.ru (SEO_Fraud)"; content:"|06|zitpaw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zojzk.ru (SEO_Fraud)"; content:"|05|zojzk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoogut.ru (SEO_Fraud)"; content:"|06|zoogut|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoolaw.ru (SEO_Fraud)"; content:"|06|zoolaw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zpbko.ru (SEO_Fraud)"; content:"|05|zpbko|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zyvwh.ru (SEO_Fraud)"; content:"|05|zyvwh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3njx.ru (Malware_Distribution)"; content:"|04|3njx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4yourcsecret.co.tv (Botnet_C&C)"; content:"|0c|4yourcsecret|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actmud.ru (SEO_Fraud)"; content:"|06|actmud|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actpot.ru (SEO_Fraud)"; content:"|06|actpot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alecat.ru (SEO_Fraud)"; content:"|06|alecat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allpup.ru (SEO_Fraud)"; content:"|06|allpup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amplaw.ru (SEO_Fraud)"; content:"|06|amplaw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ampyak.ru (SEO_Fraud)"; content:"|06|ampyak|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ampzoo.ru (SEO_Fraud)"; content:"|06|ampzoo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidrxdrugstore.net (SEO_Fraud)"; content:"|12|androidrxdrugstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidtabletsmeds.net (SEO_Fraud)"; content:"|12|androidtabletsmeds|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidtabletspharmacy.com (SEO_Fraud)"; content:"|16|androidtabletspharmacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidtabletspills.net (SEO_Fraud)"; content:"|13|androidtabletspills|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anthat.ru (SEO_Fraud)"; content:"|06|anthat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anthonyhealthmeds.com (SEO_Fraud)"; content:"|11|anthonyhealthmeds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aplecasit.com (SEO_Fraud)"; content:"|09|aplecasit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup applepharmacymeds.com (SEO_Fraud)"; content:"|11|applepharmacymeds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aprpharmacytabletsrx.com (SEO_Fraud)"; content:"|14|aprpharmacytabletsrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aprrxpills.net (SEO_Fraud)"; content:"|0a|aprrxpills|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aprtabletsrx.com (SEO_Fraud)"; content:"|0c|aprtabletsrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armlaw.ru (SEO_Fraud)"; content:"|06|armlaw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aronlevitrawiki.com (SEO_Fraud)"; content:"|0f|aronlevitrawiki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arontrawiki.com (SEO_Fraud)"; content:"|0b|arontrawiki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ashpit.ru (SEO_Fraud)"; content:"|06|ashpit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asp6.su (Malware_Distribution)"; content:"|04|asp6|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asp8.su (Malware_Distribution)"; content:"|04|asp8|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aspx2.su (Malware_Distribution)"; content:"|05|aspx2|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aspx7.su (Malware_Distribution)"; content:"|05|aspx7|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aspx9.su (Malware_Distribution)"; content:"|05|aspx9|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assaystorepillspharmacy.net (SEO_Fraud)"; content:"|17|assaystorepillspharmacy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assaystorerxpills.com (SEO_Fraud)"; content:"|11|assaystorerxpills|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b06.su (Malware_Distribution)"; content:"|03|b06|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup balanceblood.com (SEO_Fraud)"; content:"|0c|balanceblood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bambulka221.ru (Malware_Distribution)"; content:"|0b|bambulka221|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bankconfirm.su (Malware_Distribution)"; content:"|0b|bankconfirm|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bankruptcymedsdrugstore.com (SEO_Fraud)"; content:"|17|bankruptcymedsdrugstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bankupdate.su (Malware_Distribution)"; content:"|0a|bankupdate|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bankverify.su (Malware_Distribution)"; content:"|0a|bankverify|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup batgas.ru (SEO_Fraud)"; content:"|06|batgas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baypan.ru (SEO_Fraud)"; content:"|06|baypan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beachcialispharm.com (SEO_Fraud)"; content:"|10|beachcialispharm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedamp.ru (SEO_Fraud)"; content:"|06|bedamp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedego.ru (SEO_Fraud)"; content:"|06|bedego|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beryvsexnasex.ru (Malware_Distribution)"; content:"|0d|beryvsexnasex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsoftdownloadplacenow.com (SEO_Fraud)"; content:"|18|bestsoftdownloadplacenow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsoftwareonlinestock.com (SEO_Fraud)"; content:"|17|bestsoftwareonlinestock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beyry.ru (Malware_Distribution)"; content:"|05|beyry|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitterpill.ru (SEO_Fraud)"; content:"|0a|bitterpill|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blatundalqik.ru (Malware_Distribution)"; content:"|0c|blatundalqik|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blockbustermedsdrugstore.com (SEO_Fraud)"; content:"|18|blockbustermedsdrugstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blockbusterpharmacydrugstore.net (SEO_Fraud)"; content:"|1c|blockbusterpharmacydrugstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blockbusterpharmacystore.net (SEO_Fraud)"; content:"|18|blockbusterpharmacystore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluebroken.com (SEO_Fraud)"; content:"|0a|bluebroken|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluepillsrx.ru (SEO_Fraud)"; content:"|0b|bluepillsrx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boehnerhealthcare.com (SEO_Fraud)"; content:"|11|boehnerhealthcare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boehnerherbal.com (SEO_Fraud)"; content:"|0d|boehnerherbal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bogpod.ru (SEO_Fraud)"; content:"|06|bogpod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boilingfertile.com (SEO_Fraud)"; content:"|0e|boilingfertile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookchance.com (SEO_Fraud)"; content:"|0a|bookchance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boylevitrawiki.com (SEO_Fraud)"; content:"|0e|boylevitrawiki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boyrag.ru (SEO_Fraud)"; content:"|06|boyrag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boyson.ru (SEO_Fraud)"; content:"|06|boyson|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boytrawiki.com (SEO_Fraud)"; content:"|0a|boytrawiki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bpmedspills.com (SEO_Fraud)"; content:"|0b|bpmedspills|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bpmedspills.net (SEO_Fraud)"; content:"|0b|bpmedspills|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bppharmacymedspills.com (SEO_Fraud)"; content:"|13|bppharmacymedspills|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bpspills.net (SEO_Fraud)"; content:"|08|bpspills|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bronzerdrugstore.net (SEO_Fraud)"; content:"|10|bronzerdrugstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bronzerdrugstorerxpills.net (SEO_Fraud)"; content:"|17|bronzerdrugstorerxpills|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bronzerpills.net (SEO_Fraud)"; content:"|0c|bronzerpills|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bronzerrxmeds.com (SEO_Fraud)"; content:"|0d|bronzerrxmeds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bronzerrxpills.net (SEO_Fraud)"; content:"|0e|bronzerrxpills|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bruinspill.com (SEO_Fraud)"; content:"|0a|bruinspill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brushflower.com (SEO_Fraud)"; content:"|0b|brushflower|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup btbtb.ru (SEO_Fraud)"; content:"|05|btbtb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bugear.ru (SEO_Fraud)"; content:"|06|bugear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulbknee.com (SEO_Fraud)"; content:"|08|bulbknee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buntab.ru (SEO_Fraud)"; content:"|06|buntab|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup busdot.ru (SEO_Fraud)"; content:"|06|busdot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buydrugshealth.com (SEO_Fraud)"; content:"|0e|buydrugshealth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byfquytsix.com (SEO_Fraud)"; content:"|0a|byfquytsix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bzvmmruqnqgwgip.biz (Botnet_C&C)"; content:"|0f|bzvmmruqnqgwgip|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c0m.li (Malware_Infectors)"; content:"|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cangun.ru (SEO_Fraud)"; content:"|06|cangun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cantax.ru (SEO_Fraud)"; content:"|06|cantax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cargozones.com (SEO_Fraud)"; content:"|0a|cargozones|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caryou.ru (SEO_Fraud)"; content:"|06|caryou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup causeany.com (SEO_Fraud)"; content:"|08|causeany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup causeanys.com (SEO_Fraud)"; content:"|09|causeanys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cb3f.ru (Malware_Distribution)"; content:"|04|cb3f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup certainegg.com (SEO_Fraud)"; content:"|0a|certainegg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfbutgnvwuvtvnpm.biz (Botnet_C&C)"; content:"|10|cfbutgnvwuvtvnpm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chargeyourorder.com (Malware_Distribution)"; content:"|0f|chargeyourorder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chetin.in (Malware_Distribution)"; content:"|06|chetin|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chiefchest.com (SEO_Fraud)"; content:"|0a|chiefchest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickbleach.org (Malware_Distribution)"; content:"|0b|clickbleach|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnld.ru (Malware_Distribution)"; content:"|04|cnld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collingimoveis.com.br (Malware_Distribution)"; content:"|0e|collingimoveis|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup confirm.su (Malware_Distribution)"; content:"|07|confirm|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corkchest.com (SEO_Fraud)"; content:"|09|corkchest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coughengine.com (SEO_Fraud)"; content:"|0b|coughengine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cowguy.ru (SEO_Fraud)"; content:"|06|cowguy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cowpan.ru (SEO_Fraud)"; content:"|06|cowpan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cqgsmkvofkskhcm.com (Botnet_C&C)"; content:"|0f|cqgsmkvofkskhcm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup criket-trans.com (SEO_Fraud)"; content:"|0c|criket-trans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup csa-shipping.net (SEO_Fraud)"; content:"|0c|csa-shipping|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuciyupo.comyr.com (Botnet_C&C)"; content:"|08|cuciyupo|05|comyr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupcar.ru (SEO_Fraud)"; content:"|06|cupcar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupelf.ru (SEO_Fraud)"; content:"|06|cupelf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dadtoe.ru (SEO_Fraud)"; content:"|06|dadtoe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbdata-check.com (Zeus_Zbot_SpyEye)"; content:"|0c|dbdata-check|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup didid.nl (Botnet_C&C)"; content:"|05|didid|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dire-straits.co.uk (Malware_Distribution)"; content:"|0c|dire-straits|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dogjar.ru (SEO_Fraud)"; content:"|06|dogjar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dogpit.ru (SEO_Fraud)"; content:"|06|dogpit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doroty.in (SEO_Fraud)"; content:"|06|doroty|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotpod.ru (SEO_Fraud)"; content:"|06|dotpod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweighttravel.ru (SEO_Fraud)"; content:"|10|dropweighttravel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightvideo.ru (SEO_Fraud)"; content:"|0f|dropweightvideo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightweb.ru (SEO_Fraud)"; content:"|0d|dropweightweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightworld.ru (SEO_Fraud)"; content:"|0f|dropweightworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightyou.ru (SEO_Fraud)"; content:"|0d|dropweightyou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dtrizsfnkstouxl.com (Botnet_C&C)"; content:"|0f|dtrizsfnkstouxl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvulxfqzqkpeoeq.com (Botnet_C&C)"; content:"|0f|dvulxfqzqkpeoeq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dyedog.ru (SEO_Fraud)"; content:"|06|dyedog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earink.ru (SEO_Fraud)"; content:"|06|earink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earthgeneral.com (SEO_Fraud)"; content:"|0c|earthgeneral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eastbreath.com (SEO_Fraud)"; content:"|0a|eastbreath|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup econfirm.su (Malware_Distribution)"; content:"|08|econfirm|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edarambula.com (Botnet_C&C)"; content:"|0a|edarambula|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edeiawceyus.com ()"; content:"|0b|edeiawceyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eggarm.ru (SEO_Fraud)"; content:"|06|eggarm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekvzihhimwqyq.com (Botnet_C&C)"; content:"|0d|ekvzihhimwqyq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup en.bjork2.com (Malware_Distribution)"; content:"|02|en|06|bjork2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup europaforwarding.net (SEO_Fraud)"; content:"|10|europaforwarding|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fangap.ru (SEO_Fraud)"; content:"|06|fangap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastdownloadsoftwareservice.com (SEO_Fraud)"; content:"|1b|fastdownloadsoftwareservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsoftwaredownloadstore.com (SEO_Fraud)"; content:"|19|fastsoftwaredownloadstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsoftwaredownloadstore.net (SEO_Fraud)"; content:"|19|fastsoftwaredownloadstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fatgas.ru (SEO_Fraud)"; content:"|06|fatgas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffacebookimg.com (Malware_Distribution)"; content:"|0c|ffacebookimg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findtree.org (Malware_Distribution)"; content:"|08|findtree|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup floorslim.com (SEO_Fraud)"; content:"|09|floorslim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flowingforeignera.info (Malware_Distribution)"; content:"|11|flowingforeignera|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flowinghighnesse.info (Malware_Distribution)"; content:"|10|flowinghighnesse|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flowstriald.info (Malware_Distribution)"; content:"|0b|flowstriald|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup followedventedi.info (Malware_Distribution)"; content:"|0f|followedventedi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup followinggrievancesd.info (Malware_Distribution)"; content:"|14|followinggrievancesd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup followsdifficultyd.info (Malware_Distribution)"; content:"|12|followsdifficultyd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fondinformals.info (Malware_Distribution)"; content:"|0d|fondinformals|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foodinstitutedl.info (Malware_Distribution)"; content:"|0f|foodinstitutedl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup footingvicesd.info (Malware_Distribution)"; content:"|0d|footingvicesd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup footmarkedl.info (Malware_Distribution)"; content:"|0b|footmarkedl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foremostcaptivess.info (Malware_Distribution)"; content:"|11|foremostcaptivess|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foremostthirtyl.info (Malware_Distribution)"; content:"|0f|foremostthirtyl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forestprocurez.info (Malware_Distribution)"; content:"|0e|forestprocurez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forestsbadi.info (Malware_Distribution)"; content:"|0b|forestsbadi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forestsnexty.info (Malware_Distribution)"; content:"|0c|forestsnexty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forgiveuniformi.info (Malware_Distribution)"; content:"|0f|forgiveuniformi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forgottenconstrainty.info (Malware_Distribution)"; content:"|14|forgottenconstrainty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forgottengoldy.info (Malware_Distribution)"; content:"|0e|forgottengoldy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup formalitiesauthora.info (Malware_Distribution)"; content:"|12|formalitiesauthora|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup formingdisabledy.info (Malware_Distribution)"; content:"|10|formingdisabledy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fortitudeintentionu.info (Malware_Distribution)"; content:"|13|fortitudeintentionu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forwardrecallingz.info (Malware_Distribution)"; content:"|11|forwardrecallingz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fqmkfrkmukwvhnu.biz (Botnet_C&C)"; content:"|0f|fqmkfrkmukwvhnu|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getitbigz.com (SEO_Fraud)"; content:"|09|getitbigz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glocservices.com (SEO_Fraud)"; content:"|0c|glocservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gnpqhlwownqllp.org (Botnet_C&C)"; content:"|0e|gnpqhlwownqllp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldforex17.in (Malware_Distribution)"; content:"|0b|goldforex17|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotitstiff.com (SEO_Fraud)"; content:"|0a|gotitstiff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gqpllzmsllnpmnrp.info (Botnet_C&C)"; content:"|10|gqpllzmsllnpmnrp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatjazz.ru (Botnet_C&C)"; content:"|09|greatjazz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenagainst.com (SEO_Fraud)"; content:"|0c|greenagainst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helenpotters.com (Malware_Distribution)"; content:"|0c|helenpotters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helterhealh.net (Zeus_Zbot_SpyEye)"; content:"|0b|helterhealh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herbaltabletgroup.com (SEO_Fraud)"; content:"|11|herbaltabletgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitant.ru (SEO_Fraud)"; content:"|06|hitant|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjmrhgxuvqvll.biz (Botnet_C&C)"; content:"|0d|hjmrhgxuvqvll|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holigilm.info (Phishing_and_Theft)"; content:"|08|holigilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hrynevrev.com (SEO_Fraud)"; content:"|09|hrynevrev|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikswildsuurqmex.com (Botnet_C&C)"; content:"|0f|ikswildsuurqmex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inaparex.com (SEO_Fraud)"; content:"|08|inaparex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indingo.ru (Botnet_C&C)"; content:"|07|indingo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inrapharm.com (SEO_Fraud)"; content:"|09|inrapharm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insane-trip.ru (Malware_Distribution)"; content:"|0b|insane-trip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iopc4.ru (Malware_Distribution)"; content:"|05|iopc4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iopoe.ru (Malware_Distribution)"; content:"|05|iopoe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup islandever.com (SEO_Fraud)"; content:"|0a|islandever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itwitier.com (Phishing_and_Theft)"; content:"|08|itwitier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwqqkhpuvnrrvqyq.org (Botnet_C&C)"; content:"|10|iwqqkhpuvnrrvqyq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iyekokillings.info (Malware_Distribution)"; content:"|0d|iyekokillings|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetp6.ru (Malware_Distribution)"; content:"|05|jetp6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetpmmpvlfmiyir.org (Botnet_C&C)"; content:"|0f|jetpmmpvlfmiyir|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jfjpdsqirhsypqnn.org (Botnet_C&C)"; content:"|10|jfjpdsqirhsypqnn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jgfjmjvswrwekdh.biz (Botnet_C&C)"; content:"|0f|jgfjmjvswrwekdh|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jizedriwu.com (SEO_Fraud)"; content:"|09|jizedriwu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsnqfptiqpoypsir.net (Botnet_C&C)"; content:"|10|jsnqfptiqpoypsir|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juc8.ru (Malware_Distribution)"; content:"|04|juc8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jwdwlqqqqiwhxkt.com (Botnet_C&C)"; content:"|0f|jwdwlqqqqiwhxkt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jxjvgqnhhudrhnj.biz (Botnet_C&C)"; content:"|0f|jxjvgqnhhudrhnj|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup killingsbaq.info (Malware_Distribution)"; content:"|0b|killingsbaq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kissbit.com (SEO_Fraud)"; content:"|07|kissbit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kltwkhpvtqljk.com (Botnet_C&C)"; content:"|0d|kltwkhpvtqljk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klubni4kaporkaxxx.ru (Malware_Distribution)"; content:"|11|klubni4kaporkaxxx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krirfqkmckkssgol.biz (Botnet_C&C)"; content:"|10|krirfqkmckkssgol|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwimkfollrljfxo.biz (Botnet_C&C)"; content:"|0f|kwimkfollrljfxo|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lajefa.fm (Malware_Distribution)"; content:"|06|lajefa|02|fm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup landchin.com (SEO_Fraud)"; content:"|08|landchin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ljqvztjmhtstllvn.com (Botnet_C&C)"; content:"|10|ljqvztjmhtstllvn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lnrvqjrwxphioj.org (Botnet_C&C)"; content:"|0e|lnrvqjrwxphioj|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup locm.ru (Malware_Distribution)"; content:"|04|locm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loginverify.su (Malware_Distribution)"; content:"|0b|loginverify|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loiixmokqrtfoue.com (Botnet_C&C)"; content:"|0f|loiixmokqrtfoue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loopk.ru (Malware_Distribution)"; content:"|05|loopk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lufthansa-shipping-cargo.com (SEO_Fraud)"; content:"|18|lufthansa-shipping-cargo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lumqheuhpqwyjmn.com (Botnet_C&C)"; content:"|0f|lumqheuhpqwyjmn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lv1shop.com (Malware_Distribution)"; content:"|07|lv1shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzywmqlulenlmx.biz (Botnet_C&C)"; content:"|0e|lzywmqlulenlmx|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mekey.ru (SEO_Fraud)"; content:"|05|mekey|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup militarymodels.co.nz (Botnet_C&C)"; content:"|0e|militarymodels|02|co|02|nz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup misskissoftheryear.net (Zeus_Zbot_SpyEye)"; content:"|12|misskissoftheryear|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mojlmqousyruioz.com (Botnet_C&C)"; content:"|0f|mojlmqousyruioz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muwrqmnnixtsfko.info (Botnet_C&C)"; content:"|0f|muwrqmnnixtsfko|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbcnews33reports.com (SEO_Fraud)"; content:"|10|nbcnews33reports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbh3.ru (Malware_Distribution)"; content:"|04|nbh3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netr2.ru (Malware_Distribution)"; content:"|05|netr2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nexgpgsycqmxgzss.biz (Botnet_C&C)"; content:"|10|nexgpgsycqmxgzss|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniqsvvlnokeqqz.com (Botnet_C&C)"; content:"|0f|nniqsvvlnokeqqz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nqtvrtngovvoqzp.biz (Botnet_C&C)"; content:"|0f|nqtvrtngovvoqzp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nucop.ru (Malware_Distribution)"; content:"|05|nucop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odnoklasssosut4len.ru (Malware_Distribution)"; content:"|12|odnoklasssosut4len|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okcd.ru (Malware_Distribution)"; content:"|04|okcd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opinionevery.com (SEO_Fraud)"; content:"|0c|opinionevery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orgiyanadnuhe.ru (Malware_Distribution)"; content:"|0d|orgiyanadnuhe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orkutgirlss.com (Malware_Distribution)"; content:"|0b|orkutgirlss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orqpikmfnuonslov.com (Botnet_C&C)"; content:"|10|orqpikmfnuonslov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orumearchsdelaltruk.info (Zeus_Zbot_SpyEye)"; content:"|13|orumearchsdelaltruk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osijjqueapcwp.org (Botnet_C&C)"; content:"|0d|osijjqueapcwp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outordor.hdfree.in (Malware_Distribution)"; content:"|08|outordor|06|hdfree|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palaciodotransfer.com.br (Malware_Distribution)"; content:"|11|palaciodotransfer|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panamvid.com (Malware_Distribution)"; content:"|08|panamvid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petbay.ru (SEO_Fraud)"; content:"|06|petbay|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsontario.com (SEO_Fraud)"; content:"|0c|pillsontario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piohrezwjkmflliu.com (Botnet_C&C)"; content:"|10|piohrezwjkmflliu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjhopgrkxnjrlqp.biz (Botnet_C&C)"; content:"|0f|pjhopgrkxnjrlqp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjjloojumliilnic.net (Botnet_C&C)"; content:"|10|pjjloojumliilnic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnnpgggfpstlmhlt.info (Botnet_C&C)"; content:"|10|pnnpgggfpstlmhlt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornojurnal4u.ru (Malware_Distribution)"; content:"|0d|pornojurnal4u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornxplayer.com ()"; content:"|0b|pornxplayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup port04.ru (Malware_Distribution)"; content:"|06|port04|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pqznywnvvgqsknnj.com (Botnet_C&C)"; content:"|10|pqznywnvvgqsknnj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup projet-equinoxe.com (Botnet_C&C)"; content:"|0f|projet-equinoxe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pubmix.ru (SEO_Fraud)"; content:"|06|pubmix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pupkovinka.ru (Malware_Distribution)"; content:"|0a|pupkovinka|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pwjpiumlrrsjmmvr.com (Botnet_C&C)"; content:"|10|pwjpiumlrrsjmmvr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qayebav.comuf.com (Botnet_C&C)"; content:"|07|qayebav|05|comuf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qidssjocjmnujl.biz (Botnet_C&C)"; content:"|0e|qidssjocjmnujl|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlhloosfitoslvdq.biz (Botnet_C&C)"; content:"|10|qlhloosfitoslvdq|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlploispxlnpoo.org (Botnet_C&C)"; content:"|0e|qlploispxlnpoo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qmhnlypxwmclioum.org (Botnet_C&C)"; content:"|10|qmhnlypxwmclioum|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qnhljvfxpyopzqu.info (Botnet_C&C)"; content:"|0f|qnhljvfxpyopzqu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rameshgaran.com (Malware_Distribution)"; content:"|0b|rameshgaran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rattsillis.com (Malware_Distribution)"; content:"|0a|rattsillis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rawyou.ru (SEO_Fraud)"; content:"|06|rawyou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redwih.in (SEO_Fraud)"; content:"|06|redwih|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjknjyjcmlqfnmq.biz (Botnet_C&C)"; content:"|0f|rjknjyjcmlqfnmq|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rkpjngevikzqtr.net (Botnet_C&C)"; content:"|0e|rkpjngevikzqtr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rljrnsxpzkmodyin.org (Botnet_C&C)"; content:"|10|rljrnsxpzkmodyin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rmrlrrhtrxmoqmm.com (Botnet_C&C)"; content:"|0f|rmrlrrhtrxmoqmm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxvinous.com (SEO_Fraud)"; content:"|08|rxvinous|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rylattention.info ()"; content:"|0c|rylattention|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rzsbrprqgjepq.org (Botnet_C&C)"; content:"|0d|rzsbrprqgjepq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saintaubinsurmer.fr (Malware_Distribution)"; content:"|10|saintaubinsurmer|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scspack230.org (Botnet_C&C)"; content:"|0a|scspack230|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdkjgndfjnf.ru (Malware_Distribution)"; content:"|0b|sdkjgndfjnf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secuds.com (SEO_Fraud)"; content:"|06|secuds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexmnogoo4enru.ru (Malware_Distribution)"; content:"|0e|sexmnogoo4enru|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sikjlprooowzpvu.com (Botnet_C&C)"; content:"|0f|sikjlprooowzpvu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slpnyrhbeuvxxtpw.org (Botnet_C&C)"; content:"|10|slpnyrhbeuvxxtpw|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smwpiqfmigjqwonu.net (Botnet_C&C)"; content:"|10|smwpiqfmigjqwonu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spiritgrass.ru (SEO_Fraud)"; content:"|0b|spiritgrass|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssl3.su (Malware_Distribution)"; content:"|04|ssl3|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssl7.su (Malware_Distribution)"; content:"|04|ssl7|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup staticplan.ru (Botnet_C&C)"; content:"|0a|staticplan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strutters-logistics.com (SEO_Fraud)"; content:"|13|strutters-logistics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sublip.ru (SEO_Fraud)"; content:"|06|sublip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumegg.ru (SEO_Fraud)"; content:"|06|sumegg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunegg.ru (SEO_Fraud)"; content:"|06|sunegg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunleg.ru (SEO_Fraud)"; content:"|06|sunleg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup szsqfilpfmdrokm.com (Botnet_C&C)"; content:"|0f|szsqfilpfmdrokm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taptea.ru (SEO_Fraud)"; content:"|06|taptea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tarbus.ru (SEO_Fraud)"; content:"|06|tarbus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toesun.ru (SEO_Fraud)"; content:"|06|toesun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tomisdel.com (SEO_Fraud)"; content:"|08|tomisdel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tophurt.be (Malware_Distribution)"; content:"|07|tophurt|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transporte-express.com (SEO_Fraud)"; content:"|12|transporte-express|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuxipkujvyquosm.net (Botnet_C&C)"; content:"|0f|tuxipkujvyquosm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ueur3.ru (Malware_Distribution)"; content:"|05|ueur3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uitppyflfsnkpxid.info (Botnet_C&C)"; content:"|10|uitppyflfsnkpxid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup umpitxbuvrupmpt.info (Botnet_C&C)"; content:"|0f|umpitxbuvrupmpt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uniquesoftdownloadsmarket.com (SEO_Fraud)"; content:"|19|uniquesoftdownloadsmarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uniquesoftstockplace.com (SEO_Fraud)"; content:"|14|uniquesoftstockplace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup userconfirm.su (Malware_Distribution)"; content:"|0b|userconfirm|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup userupdate.su (Malware_Distribution)"; content:"|0a|userupdate|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup userverify.su (Malware_Distribution)"; content:"|0a|userverify|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuupospmoxlinc.biz (Botnet_C&C)"; content:"|0e|uuupospmoxlinc|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uzvxwovtnlzrkyt.org (Botnet_C&C)"; content:"|0f|uzvxwovtnlzrkyt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vampirefishsd.com (Malware_Distribution)"; content:"|0d|vampirefishsd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup velhndvdmtxicfqn.org (Botnet_C&C)"; content:"|10|velhndvdmtxicfqn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verifybank.su (Malware_Distribution)"; content:"|0a|verifybank|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vj64.ru (Malware_Distribution)"; content:"|04|vj64|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vqskcqhtempfltx.biz (Botnet_C&C)"; content:"|0f|vqskcqhtempfltx|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vroxnpojiomtenlq.biz (Botnet_C&C)"; content:"|10|vroxnpojiomtenlq|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vxfftjwrivtwioy.org (Botnet_C&C)"; content:"|0f|vxfftjwrivtwioy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wdoyqoxnmmrlqyot.biz (Botnet_C&C)"; content:"|10|wdoyqoxnmmrlqyot|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woqmqlgnrfxwtsk.net (Botnet_C&C)"; content:"|0f|woqmqlgnrfxwtsk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrtxvmopsveiep.org (Botnet_C&C)"; content:"|0e|wrtxvmopsveiep|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwfreightservices.com (SEO_Fraud)"; content:"|11|wwfreightservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwmrrprfjoreotwq.net (Botnet_C&C)"; content:"|10|wwmrrprfjoreotwq|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwpingarchive.com (Malware_Distribution)"; content:"|0e|wwwpingarchive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmlstatreports.com (Malware_Distribution)"; content:"|0e|xmlstatreports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xnpqxuohrqpqrxi.com (Botnet_C&C)"; content:"|0f|xnpqxuohrqpqrxi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xorxtvukytppkog.net (Botnet_C&C)"; content:"|0f|xorxtvukytppkog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxfnxriwksumerp.com (Botnet_C&C)"; content:"|0f|xxfnxriwksumerp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ydjiaxiao.net (Malware_Distribution)"; content:"|09|ydjiaxiao|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yjrphvshndipprsq.biz (Botnet_C&C)"; content:"|10|yjrphvshndipprsq|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yolmstdrjisoktzl.net (Botnet_C&C)"; content:"|10|yolmstdrjisoktzl|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytpfmnmgyjinxrhe.com (Botnet_C&C)"; content:"|10|ytpfmnmgyjinxrhe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zusvdhzkjvtpimlv.org (Botnet_C&C)"; content:"|10|zusvdhzkjvtpimlv|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zynlmvlugosyiwvx.info (Botnet_C&C)"; content:"|10|zynlmvlugosyiwvx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biteedsx.ru (Fake_AV)"; content:"|08|biteedsx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hag-eng.co.il (Malware_Distribution)"; content:"|07|hag-eng|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orgasmicpics.com (Malware_Distribution)"; content:"|0c|orgasmicpics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic-analytics.net (Malware_Distribution)"; content:"|11|traffic-analytics|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustgeobiz.com (Malware_Distribution)"; content:"|0b|trustgeobiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--fct5gx28h9gs.tw (Malware_Distribution)"; content:"|10|xn--fct5gx28h9gs|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accwiz.in (Malware_Distribution)"; content:"|06|accwiz|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adultqueens.org (Malware_Distribution)"; content:"|0b|adultqueens|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belidiskalom.com (Malware_Distribution)"; content:"|0c|belidiskalom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellicbridge.ru (Zeus_Zbot_SpyEye)"; content:"|0c|bellicbridge|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup channel3online.com (SEO_Fraud)"; content:"|0e|channel3online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clinicpharmacypills.at (SEO_Fraud)"; content:"|13|clinicpharmacypills|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datacricketuf.ru (Zeus_Zbot_SpyEye)"; content:"|0d|datacricketuf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-tax-statement.com ()"; content:"|16|download-tax-statement|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstorehealthtablets.com (SEO_Fraud)"; content:"|16|drugstorehealthtablets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstoremap.com (SEO_Fraud)"; content:"|0c|drugstoremap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstorepharmaceuticsrx.com (SEO_Fraud)"; content:"|18|drugstorepharmaceuticsrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstorepharmacycigna.com (SEO_Fraud)"; content:"|16|drugstorepharmacycigna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstorepharmacycignadental.com (SEO_Fraud)"; content:"|1c|drugstorepharmacycignadental|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugtorepharmacytablets.net (SEO_Fraud)"; content:"|17|drugtorepharmacytablets|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eggzaclub.co.cc (Malware_Distribution)"; content:"|09|eggzaclub|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egoair.ru (SEO_Fraud)"; content:"|06|egoair|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egodye.ru (SEO_Fraud)"; content:"|06|egodye|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esperadooptic.ru (Zeus_Zbot_SpyEye)"; content:"|0d|esperadooptic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etfacebookss.net (Malware_Distribution)"; content:"|0c|etfacebookss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exalbot.net (Malware_Distribution)"; content:"|07|exalbot|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeute.ru (SEO_Fraud)"; content:"|06|eyeute|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fabboy.ru (SEO_Fraud)"; content:"|06|fabboy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fadbed.ru (SEO_Fraud)"; content:"|06|fadbed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fadpaw.ru (SEO_Fraud)"; content:"|06|fadpaw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanrow.ru (SEO_Fraud)"; content:"|06|fanrow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fantea.ru (SEO_Fraud)"; content:"|06|fantea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdawikidrugstore.com (SEO_Fraud)"; content:"|10|fdawikidrugstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federaltaxes-statement.com ()"; content:"|16|federaltaxes-statement|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feedchannel3.com (SEO_Fraud)"; content:"|0c|feedchannel3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feelingfoot.com (SEO_Fraud)"; content:"|0b|feelingfoot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fegleywmae.com (SEO_Fraud)"; content:"|0a|fegleywmae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmspornoxxxsexru.ru (Malware_Distribution)"; content:"|12|filmspornoxxxsexru|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup first-fosoft.uni.cc (Malware_Distribution)"; content:"|0c|first-fosoft|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup florianarray.ru (Zeus_Zbot_SpyEye)"; content:"|0c|florianarray|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxpup.ru (SEO_Fraud)"; content:"|06|foxpup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabinorland.co.uk (Malware_Distribution)"; content:"|0b|gabinorland|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaplab.ru (SEO_Fraud)"; content:"|06|gaplab|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaprip.ru (SEO_Fraud)"; content:"|06|gaprip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaspup.ru (SEO_Fraud)"; content:"|06|gaspup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gavri.be (Malware_Distribution)"; content:"|05|gavri|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genericstablet.com (SEO_Fraud)"; content:"|0e|genericstablet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genericsun.com (SEO_Fraud)"; content:"|0a|genericsun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gindad.ru (SEO_Fraud)"; content:"|06|gindad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalnewzmedia.com (SEO_Fraud)"; content:"|0f|globalnewzmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodfishing.ru (Zeus_Zbot_SpyEye)"; content:"|0b|goodfishing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greattabletmedicine.com (SEO_Fraud)"; content:"|13|greattabletmedicine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gundew.ru (SEO_Fraud)"; content:"|06|gundew|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gutice.ru (SEO_Fraud)"; content:"|06|gutice|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guypub.ru (SEO_Fraud)"; content:"|06|guypub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hatdot.ru (SEO_Fraud)"; content:"|06|hatdot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hilekoxp.com (Malware_Distribution)"; content:"|08|hilekoxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitpeg.ru (SEO_Fraud)"; content:"|06|hitpeg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hrenasdva.info (Malware_Distribution)"; content:"|09|hrenasdva|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i1match361.biz (Malware_Infectors)"; content:"|0a|i1match361|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icehog.ru (SEO_Fraud)"; content:"|06|icehog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infektekbot.tk (Malware_Infectors)"; content:"|0b|infektekbot|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inkion.ru (SEO_Fraud)"; content:"|06|inkion|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intercessorlaidi.info (Malware_Distribution)"; content:"|10|intercessorlaidi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intercoursecharacterd.info (Malware_Distribution)"; content:"|15|intercoursecharacterd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internalrealityy.info (Malware_Distribution)"; content:"|10|internalrealityy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interpretermete.info (Malware_Distribution)"; content:"|0f|interpretermete|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interpreterthrones.info (Malware_Distribution)"; content:"|12|interpreterthrones|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interrednavigations.info (Malware_Distribution)"; content:"|13|interrednavigations|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interruptconceiveds.info (Malware_Distribution)"; content:"|13|interruptconceiveds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intriguefeastsa.info (Malware_Distribution)"; content:"|0f|intriguefeastsa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inundationsstronglyz.info (Malware_Distribution)"; content:"|14|inundationsstronglyz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inviolableknewy.info (Malware_Distribution)"; content:"|0f|inviolableknewy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup involuntaryships.info (Malware_Distribution)"; content:"|10|involuntaryships|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ionpit.ru (SEO_Fraud)"; content:"|06|ionpit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irewatchedl.info (Malware_Distribution)"; content:"|0b|irewatchedl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irregularapprehensived.info (Malware_Distribution)"; content:"|16|irregularapprehensived|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irregularmethodsy.info (Malware_Distribution)"; content:"|11|irregularmethodsy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irritatedelementss.info (Malware_Distribution)"; content:"|12|irritatedelementss|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irs-alert-security.com ()"; content:"|12|irs-alert-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irs-investigation.com (Phishing_and_Theft)"; content:"|11|irs-investigation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irs-reportid-2944.com ()"; content:"|11|irs-reportid-2944|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irs-security-agency.com ()"; content:"|13|irs-security-agency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup islandafternoont.info (Malware_Distribution)"; content:"|10|islandafternoont|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup islandsufferi.info (Malware_Distribution)"; content:"|0d|islandsufferi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jarsax.ru (SEO_Fraud)"; content:"|06|jarsax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jarsun.ru (SEO_Fraud)"; content:"|06|jarsun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kidaxe.ru (SEO_Fraud)"; content:"|06|kidaxe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labtin.ru (SEO_Fraud)"; content:"|06|labtin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legfox.ru (SEO_Fraud)"; content:"|06|legfox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legtie.ru (SEO_Fraud)"; content:"|06|legtie|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lightchannelnews.com (SEO_Fraud)"; content:"|10|lightchannelnews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-bot.net (Malware_Distribution)"; content:"|08|live-bot|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup looseweightfast.ru (SEO_Fraud)"; content:"|0f|looseweightfast|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lvhook.biz (Malware_Infectors)"; content:"|06|lvhook|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mahimamahila.com (Malware_Distribution)"; content:"|0c|mahimamahila|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maprib.ru (SEO_Fraud)"; content:"|06|maprib|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariko5.ru (Malware_Distribution)"; content:"|07|mariko5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matfox.ru (SEO_Fraud)"; content:"|06|matfox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matlip.ru (SEO_Fraud)"; content:"|06|matlip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medialine3.com (SEO_Fraud)"; content:"|0a|medialine3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medonlinestores.com (SEO_Fraud)"; content:"|0f|medonlinestores|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup menjar.ru (SEO_Fraud)"; content:"|06|menjar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mickid.ru (SEO_Fraud)"; content:"|06|mickid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mictie.ru (SEO_Fraud)"; content:"|06|mictie|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miczit.ru (SEO_Fraud)"; content:"|06|miczit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mixmat.ru (SEO_Fraud)"; content:"|06|mixmat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mixrag.ru (SEO_Fraud)"; content:"|06|mixrag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momcar.ru (SEO_Fraud)"; content:"|06|momcar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mudcar.ru (SEO_Fraud)"; content:"|06|mudcar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mudpad.ru (SEO_Fraud)"; content:"|06|mudpad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mumtow.ru (SEO_Fraud)"; content:"|06|mumtow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mumute.ru (SEO_Fraud)"; content:"|06|mumute|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neglectstoringi.info (Malware_Distribution)"; content:"|0f|neglectstoringi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neitherrivers.info (Malware_Distribution)"; content:"|0d|neitherrivers|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup news-7days.net (Malware_Distribution)"; content:"|0a|news-7days|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nutamp.ru (SEO_Fraud)"; content:"|06|nutamp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nw-serv.cc (Malware_Distribution)"; content:"|07|nw-serv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup originallyvoluntaryy.info (Malware_Distribution)"; content:"|14|originallyvoluntaryy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup originatorsignl.info (Malware_Distribution)"; content:"|0f|originatorsignl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ottokesastraws.info (Malware_Distribution)"; content:"|0e|ottokesastraws|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ottokessareachedy.info (Malware_Distribution)"; content:"|11|ottokessareachedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oughtlowery.info (Malware_Distribution)"; content:"|0b|oughtlowery|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outsetcomfortede.info (Malware_Distribution)"; content:"|10|outsetcomfortede|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overbearingentreaty.info (Malware_Distribution)"; content:"|13|overbearingentreaty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup owedhelplessd.info (Malware_Distribution)"; content:"|0d|owedhelplessd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup owesdeterminedi.info (Malware_Distribution)"; content:"|0f|owesdeterminedi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup owesofficialsi.info (Malware_Distribution)"; content:"|0e|owesofficialsi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ownroughz.info (Malware_Distribution)"; content:"|09|ownroughz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup packedwindt.info (Malware_Distribution)"; content:"|0b|packedwindt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paintingsconcertedl.info (Malware_Distribution)"; content:"|13|paintingsconcertedl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paintrusti.info (Malware_Distribution)"; content:"|0a|paintrusti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pairexcited.info (Malware_Distribution)"; content:"|0b|pairexcited|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paradedungeonsy.info (Malware_Distribution)"; content:"|0f|paradedungeonsy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paragraphdroppeds.info (Malware_Distribution)"; content:"|11|paragraphdroppeds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parelav.com (Malware_Distribution)"; content:"|07|parelav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parentsmakinga.info (Malware_Distribution)"; content:"|0e|parentsmakinga|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parksdiffersy.info (Malware_Distribution)"; content:"|0d|parksdiffersy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pashacomplainty.info (Malware_Distribution)"; content:"|0f|pashacomplainty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup passionateenjoymenti.info (Malware_Distribution)"; content:"|14|passionateenjoymenti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patentabolishedd.info (Malware_Distribution)"; content:"|10|patentabolishedd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pathbanqueti.info (Malware_Distribution)"; content:"|0c|pathbanqueti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pell-grant.biz ()"; content:"|0a|pell-grant|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pellicslotersa.ru (Zeus_Zbot_SpyEye)"; content:"|0e|pellicslotersa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfectpowerslim.com (SEO_Fraud)"; content:"|10|perfectpowerslim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup play-support-email.com (Malware_Distribution)"; content:"|12|play-support-email|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornoxnx-conline3a.ru (Malware_Distribution)"; content:"|12|pornoxnx-conline3a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerslimdirect.com (SEO_Fraud)"; content:"|0f|powerslimdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prisonofficer.org (Malware_Distribution)"; content:"|0d|prisonofficer|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-secure.ru (Malware_Distribution)"; content:"|0e|protect-secure|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raveruporevotrax.ru (Malware_Distribution)"; content:"|10|raveruporevotrax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reportfiledownload-irs.com ()"; content:"|16|reportfiledownload-irs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundbrother.com (SEO_Fraud)"; content:"|0c|roundbrother|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup routerstructo.ru (Zeus_Zbot_SpyEye)"; content:"|0d|routerstructo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sabgxnysyus.com (Malware_Distribution)"; content:"|0b|sabgxnysyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sagliklibeslenmeurunleri.com (Malware_Distribution)"; content:"|18|sagliklibeslenmeurunleri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup schoolnames.co.uk (Malware_Distribution)"; content:"|0b|schoolnames|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seforums.biz (Malware_Distribution)"; content:"|08|seforums|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sfglsdesyus.com (Malware_Distribution)"; content:"|0b|sfglsdesyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simulatormage.ru (Zeus_Zbot_SpyEye)"; content:"|0d|simulatormage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slimmonth.com (SEO_Fraud)"; content:"|09|slimmonth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softdavid.net (Malware_Distribution)"; content:"|09|softdavid|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonysearch.com (Malware_Distribution)"; content:"|0a|sonysearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup summertimebuy.com (SEO_Fraud)"; content:"|0d|summertimebuy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superxxxpornotraxsex.ru (Malware_Distribution)"; content:"|14|superxxxpornotraxsex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamarindo-immobilier.com (Malware_Distribution)"; content:"|14|tamarindo-immobilier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tax-antifraud.com (Phishing_and_Theft)"; content:"|0d|tax-antifraud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tridentcapmgt.com (Malware_Infectors)"; content:"|0d|tridentcapmgt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unfriendlyalivee.info (Malware_Distribution)"; content:"|10|unfriendlyalivee|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ungratefuloxeny.info (Malware_Distribution)"; content:"|0f|ungratefuloxeny|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unimpededresultede.info (Malware_Distribution)"; content:"|12|unimpededresultede|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uninjuredrooty.info (Malware_Distribution)"; content:"|0e|uninjuredrooty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unsatisfactorywarml.info (Malware_Distribution)"; content:"|13|unsatisfactorywarml|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unsuitableladenl.info (Malware_Distribution)"; content:"|10|unsuitableladenl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updated3news.com (SEO_Fraud)"; content:"|0c|updated3news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us-federalwire.com (Phishing_and_Theft)"; content:"|0e|us-federalwire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us-feraltaxsecurity.com ()"; content:"|13|us-feraltaxsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us-tax-report.com ()"; content:"|0d|us-tax-report|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us-taxes-alerts.com ()"; content:"|0f|us-taxes-alerts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viagraboink.com (SEO_Fraud)"; content:"|0b|viagraboink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxmx-onlina4b.ru (Malware_Distribution)"; content:"|11|videoxmx-onlina4b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup view-tax-statement.com (Phishing_and_Theft)"; content:"|12|view-tax-statement|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webtar.ru (SEO_Fraud)"; content:"|06|webtar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weeksjewishy.info (Malware_Distribution)"; content:"|0c|weeksjewishy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weightexcusez.info (Malware_Distribution)"; content:"|0d|weightexcusez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westwardungovernabled.info (Malware_Distribution)"; content:"|15|westwardungovernabled|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wheelbarrowsgemsi.info (Malware_Distribution)"; content:"|11|wheelbarrowsgemsi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whereverreturnse.info (Malware_Distribution)"; content:"|10|whereverreturnse|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wifepaintingsl.info (Malware_Distribution)"; content:"|0e|wifepaintingsl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wildforthy.info (Malware_Distribution)"; content:"|0a|wildforthy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup willspreadd.info (Malware_Distribution)"; content:"|0b|willspreadd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsraisingl.info (Malware_Distribution)"; content:"|0f|windowsraisingl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winerewardd.info (Malware_Distribution)"; content:"|0b|winerewardd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wolfenbuttelhelmi.info (Malware_Distribution)"; content:"|11|wolfenbuttelhelmi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup world3channel.com (SEO_Fraud)"; content:"|0d|world3channel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup world3newz.com (SEO_Fraud)"; content:"|0a|world3newz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup writersreasonabley.info (Malware_Distribution)"; content:"|12|writersreasonabley|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhotvids44.tk (Malware_Distribution)"; content:"|0a|xhotvids44|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhotvids89.tk (Malware_Distribution)"; content:"|0a|xhotvids89|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xiidikesz.info (Malware_Distribution)"; content:"|09|xiidikesz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yachtconsideringy.info (Malware_Distribution)"; content:"|11|yachtconsideringy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yesasia-support.com (Malware_Distribution)"; content:"|0f|yesasia-support|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youngmetal.ru (Zeus_Zbot_SpyEye)"; content:"|0a|youngmetal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ywase.info (Malware_Distribution)"; content:"|05|ywase|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-kotech.co.kr (Fake_AV)"; content:"|08|e-kotech|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3626karikal.start.tl (Malware_Distribution)"; content:"|0b|3626karikal|05|start|02|tl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aefpesjayus.com (Malware_Infectors)"; content:"|0b|aefpesjayus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agentbundeskriminalamt.net (Fake_AV)"; content:"|16|agentbundeskriminalamt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahouthoghim.com (SEO_Fraud)"; content:"|0b|ahouthoghim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidspillsdrugstore.net (SEO_Fraud)"; content:"|16|androidspillsdrugstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidspillsmeds.net (SEO_Fraud)"; content:"|11|androidspillsmeds|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidtabletsrx.com (SEO_Fraud)"; content:"|10|androidtabletsrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appspillsdrugstore.net (SEO_Fraud)"; content:"|12|appspillsdrugstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appstabletsrx.net (SEO_Fraud)"; content:"|0d|appstabletsrx|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup augmepeid.com (SEO_Fraud)"; content:"|09|augmepeid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babeq.ru (SEO_Fraud)"; content:"|05|babeq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bafaf.ru (SEO_Fraud)"; content:"|05|bafaf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banlueak.com (Malware_Distribution)"; content:"|08|banlueak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbva-es.com (Fake_AV)"; content:"|07|bbva-es|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belygaur.in (Malware_Distribution)"; content:"|08|belygaur|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestof123.info (Malware_Infectors)"; content:"|09|bestof123|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bjglvgsxteki.tk (Malware_Distribution)"; content:"|0c|bjglvgsxteki|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bundeskriminalamtde.net (Fake_AV)"; content:"|13|bundeskriminalamtde|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bundespol.com (Fake_AV)"; content:"|09|bundespol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bundespol.net (Malware_Distribution)"; content:"|09|bundespol|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bundespolizei-de.net (Fake_AV)"; content:"|10|bundespolizei-de|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bundespolizei-de.org (Fake_AV)"; content:"|10|bundespolizei-de|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bundespolizei-online.com (Fake_AV)"; content:"|14|bundespolizei-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ca-jobcareer.com (Fake_AV)"; content:"|0c|ca-jobcareer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cabgxrycyus.com (Malware_Infectors)"; content:"|0b|cabgxrycyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbchhuacyus.com (Botnet_C&C)"; content:"|0b|cbchhuacyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clarotorps.h1.ru (Malware_Distribution)"; content:"|0a|clarotorps|02|h1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contextwkh.tk (Malware_Distribution)"; content:"|0a|contextwkh|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-cvkjx.cx.cc (Malware_Distribution)"; content:"|0e|defender-cvkjx|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-dmolx.cx.cc (Malware_Distribution)"; content:"|0e|defender-dmolx|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dpolg-bundespolizei.org (Fake_AV)"; content:"|13|dpolg-bundespolizei|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstorepaperpills.com (SEO_Fraud)"; content:"|13|drugstorepaperpills|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstorepharmaciesrx.com (SEO_Fraud)"; content:"|15|drugstorepharmaciesrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstorepharmacydental.com (SEO_Fraud)"; content:"|17|drugstorepharmacydental|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugtorehealthtabletscare.com (SEO_Fraud)"; content:"|19|drugtorehealthtabletscare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugtoreprescriptionmedspharmacy.com (SEO_Fraud)"; content:"|20|drugtoreprescriptionmedspharmacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elifkocsurucukursu.com (Malware_Distribution)"; content:"|12|elifkocsurucukursu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup en-softonic.net (Malware_Distribution)"; content:"|0b|en-softonic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expendiczkr.uni.cc (Malware_Distribution)"; content:"|0b|expendiczkr|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeblaster-t1.com (Malware_Distribution)"; content:"|0d|eyeblaster-t1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gcdjqvbgyus.com (Malware_Infectors)"; content:"|0b|gcdjqvbgyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodeating.info (Zeus_Zbot_SpyEye)"; content:"|0a|goodeating|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grupobogue.com.ar (Malware_Distribution)"; content:"|0a|grupobogue|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hs666.net (Malware_Infectors)"; content:"|05|hs666|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibccmsuiyus.com (Botnet_C&C)"; content:"|0b|ibccmsuiyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup incredibleoutcomes.com (Malware_Distribution)"; content:"|12|incredibleoutcomes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter-bundeskriminalamt.eu (Fake_AV)"; content:"|17|inter-bundeskriminalamt|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter-bundeskriminalamt.org (Fake_AV)"; content:"|17|inter-bundeskriminalamt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kineticgames.info (Malware_Distribution)"; content:"|0c|kineticgames|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ksadamar.com (Malware_Distribution)"; content:"|08|ksadamar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lamatita.info (Spyware)"; content:"|08|lamatita|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livedieoslix.com (Malware_Distribution)"; content:"|0c|livedieoslix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malavasso.com (Malware_Infectors)"; content:"|09|malavasso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miaatjsmyus.com (Malware_Infectors)"; content:"|0b|miaatjsmyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miafoqxmyus.com (Malware_Infectors)"; content:"|0b|miafoqxmyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup migraviro.com (Malware_Infectors)"; content:"|09|migraviro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mjiiarcmyus.com (Malware_Distribution)"; content:"|0b|mjiiarcmyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mlaimport.com (Malware_Distribution)"; content:"|09|mlaimport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnedw.info (Malware_Infectors)"; content:"|05|mnedw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup montenegrorio.com (Malware_Infectors)"; content:"|0d|montenegrorio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mrfuture22.no-ip.biz (Malware_Distribution)"; content:"|0a|mrfuture22|05|no-ip|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordea-fis.com (Fake_AV)"; content:"|0a|nordea-fis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2654999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordea-if.com (Fake_AV)"; content:"|09|nordea-if|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordea-vf.com (Fake_AV)"; content:"|09|nordea-vf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordeasfi.com (Fake_AV)"; content:"|09|nordeasfi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nynzbif.co.cc (Malware_Distribution)"; content:"|07|nynzbif|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinebundeskriminalamt.net (Fake_AV)"; content:"|17|onlinebundeskriminalamt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osuuspankki-fi.com (Fake_AV)"; content:"|0e|osuuspankki-fi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pacman.net.in (Zeus_Zbot_SpyEye)"; content:"|06|pacman|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pajamaaa.info (Malware_Infectors)"; content:"|08|pajamaaa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxmx-conline3b.ru (Malware_Distribution)"; content:"|12|porkaxmx-conline3b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxmx-freex1c.ru (Malware_Distribution)"; content:"|10|porkaxmx-freex1c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxxx-freex5f.ru (Malware_Distribution)"; content:"|10|porkaxxx-freex5f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup posterityn71.com ()"; content:"|0c|posterityn71|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pw2.ro (Malware_Infectors)"; content:"|03|pw2|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qcddvrvqyus.com (Malware_Infectors)"; content:"|0b|qcddvrvqyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtorarcf.com (Malware_Distribution)"; content:"|0b|realtorarcf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rifepfl61.com ()"; content:"|09|rifepfl61|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxherbalkava.com (SEO_Fraud)"; content:"|0c|rxherbalkava|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sahoreen.in (Malware_Distribution)"; content:"|08|sahoreen|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selectionmusic.co.za (Spyware)"; content:"|0e|selectionmusic|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexualtablethealth.com (SEO_Fraud)"; content:"|12|sexualtablethealth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopmedicinerx.com (SEO_Fraud)"; content:"|0e|shopmedicinerx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoppharmacyrx.com (SEO_Fraud)"; content:"|0e|shoppharmacyrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoppillstablets.com (SEO_Fraud)"; content:"|10|shoppillstablets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoptabletspills.com (SEO_Fraud)"; content:"|10|shoptabletspills|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sigsypri.net (SEO_Fraud)"; content:"|08|sigsypri|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skovia.com (Malware_Distribution)"; content:"|06|skovia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sokoloperkovuskeci.com (Malware_Infectors)"; content:"|12|sokoloperkovuskeci|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soninkara.org (Malware_Distribution)"; content:"|09|soninkara|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soudckrnkuzu.tk (Malware_Distribution)"; content:"|0c|soudckrnkuzu|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swampinxatb.uni.cc (Malware_Distribution)"; content:"|0b|swampinxatb|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torpormvp35.com ()"; content:"|0b|torpormvp35|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torrentbundeskriminalamt.net (Fake_AV)"; content:"|18|torrentbundeskriminalamt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uk-jobcareer.com (Fake_AV)"; content:"|0c|uk-jobcareer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usa-jobcareer.com (Fake_AV)"; content:"|0d|usa-jobcareer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wbccmquwyus.com (Botnet_C&C)"; content:"|0b|wbccmquwyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zdjecia.jor.pl (Malware_Distribution)"; content:"|07|zdjecia|03|jor|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeissopticszone.com (Malware_Distribution)"; content:"|0f|zeissopticszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zwierzu.zxy.me (Malware_Distribution)"; content:"|07|zwierzu|03|zxy|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0514job.com (Fake_AV)"; content:"|07|0514job|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 88luckybet.com (Malware_Distribution)"; content:"|0a|88luckybet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8klbw.2lkjdj.ru (Malware_Distribution)"; content:"|05|8klbw|06|2lkjdj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup absorbephq.oueb.eu (Malware_Distribution)"; content:"|0a|absorbephq|04|oueb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup animealert.com (Malware_Distribution)"; content:"|0a|animealert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bankruptcydrugstore.com (SEO_Fraud)"; content:"|13|bankruptcydrugstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biohominis.com (Malware_Distribution)"; content:"|0a|biohominis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burburis.com (Malware_Distribution)"; content:"|08|burburis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bzidwuijpay.com (SEO_Fraud)"; content:"|0b|bzidwuijpay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carehealthpillsmeds.com (SEO_Fraud)"; content:"|13|carehealthpillsmeds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cejmogezy.com (SEO_Fraud)"; content:"|09|cejmogezy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cellsdrugstoremeds.com (SEO_Fraud)"; content:"|12|cellsdrugstoremeds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cellsdrugstoremeds.net (SEO_Fraud)"; content:"|12|cellsdrugstoremeds|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centralohiocalendar.nl (SEO_Fraud)"; content:"|13|centralohiocalendar|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centsrx.com (SEO_Fraud)"; content:"|07|centsrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chefir.in (Malware_Distribution)"; content:"|06|chefir|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chemistspharmacyrx.com (SEO_Fraud)"; content:"|12|chemistspharmacyrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chlorinetabletshealth.com (SEO_Fraud)"; content:"|15|chlorinetabletshealth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chobdobru.com (SEO_Fraud)"; content:"|09|chobdobru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cignahmodrugstorepharmacyrx.com (SEO_Fraud)"; content:"|1b|cignahmodrugstorepharmacyrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cignahmopharmacyrx.com (SEO_Fraud)"; content:"|12|cignahmopharmacyrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciscoc.ru (Zeus_Zbot_SpyEye)"; content:"|06|ciscoc|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cjgyy.ru (SEO_Fraud)"; content:"|05|cjgyy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clarketab.com (SEO_Fraud)"; content:"|09|clarketab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup claytabletsdrugstore.ru (SEO_Fraud)"; content:"|14|claytabletsdrugstore|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup claytabletsdrugstorepills.at (SEO_Fraud)"; content:"|19|claytabletsdrugstorepills|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crazyhomesex.com (Malware_Distribution)"; content:"|0c|crazyhomesex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup customidet.com (Zeus_Zbot_SpyEye)"; content:"|0a|customidet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donethme.rr.nu (Malware_Distribution)"; content:"|08|donethme|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightapp.ru (SEO_Fraud)"; content:"|0d|dropweightapp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightart.ru (SEO_Fraud)"; content:"|0d|dropweightart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightauto.ru (SEO_Fraud)"; content:"|0e|dropweightauto|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightbest.ru (SEO_Fraud)"; content:"|0e|dropweightbest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightblog.ru (SEO_Fraud)"; content:"|0e|dropweightblog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightblue.ru (SEO_Fraud)"; content:"|0e|dropweightblue|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightbook.ru (SEO_Fraud)"; content:"|0e|dropweightbook|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightbox.ru (SEO_Fraud)"; content:"|0d|dropweightbox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightbusiness.ru (SEO_Fraud)"; content:"|12|dropweightbusiness|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightbuy.ru (SEO_Fraud)"; content:"|0d|dropweightbuy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightcar.ru (SEO_Fraud)"; content:"|0d|dropweightcar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightcode.ru (SEO_Fraud)"; content:"|0e|dropweightcode|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightcom.ru (SEO_Fraud)"; content:"|0d|dropweightcom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightcreative.ru (SEO_Fraud)"; content:"|12|dropweightcreative|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugpharmacypills.net (SEO_Fraud)"; content:"|11|drugpharmacypills|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugpillsmed.com (SEO_Fraud)"; content:"|0c|drugpillsmed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugsmedicineonline.com (SEO_Fraud)"; content:"|13|drugsmedicineonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugsmedicinetablets.com (SEO_Fraud)"; content:"|14|drugsmedicinetablets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstoreman.com (SEO_Fraud)"; content:"|0c|drugstoreman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugstoremedicalspecialtyrx.com (SEO_Fraud)"; content:"|1b|drugstoremedicalspecialtyrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup editial.com (Malware_Distribution)"; content:"|07|editial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elocumjobs.com (Malware_Distribution)"; content:"|0a|elocumjobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiisacebooks.com (Malware_Distribution)"; content:"|0c|fiisacebooks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flash142-hosting.sytes.net (Malware_Distribution)"; content:"|10|flash142-hosting|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup francoabdo.sitesled.com (Malware_Distribution)"; content:"|0a|francoabdo|08|sitesled|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyihosting.co.cc (Malware_Distribution)"; content:"|0a|fyihosting|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabqniigyus.com (Malware_Distribution)"; content:"|0b|gabqniigyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godaddy-networks.com (Malware_Distribution)"; content:"|10|godaddy-networks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardarmyfy.rr.nu (Malware_Distribution)"; content:"|0a|hardarmyfy|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingsupplydfwc.com ()"; content:"|0e|kingsupplydfwc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kumatoznik.ru (Malware_Distribution)"; content:"|0a|kumatoznik|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lamedicina.ru (Malware_Infectors)"; content:"|0a|lamedicina|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lawsrsx.monbe.be (Malware_Distribution)"; content:"|07|lawsrsx|05|monbe|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup likstened.com (Zeus_Zbot_SpyEye)"; content:"|09|likstened|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meganstyle.pl (Malware_Distribution)"; content:"|0a|meganstyle|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup michaelkort.com (Malware_Infectors)"; content:"|0b|michaelkort|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microssearch.com (Malware_Distribution)"; content:"|0c|microssearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mixmediadirect.cn (Malware_Distribution)"; content:"|0e|mixmediadirect|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ne97urhfhndcduhc8h.com (Malware_Distribution)"; content:"|12|ne97urhfhndcduhc8h|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netatlanta.com (Malware_Distribution)"; content:"|0a|netatlanta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordea-dk.com (Malware_Distribution)"; content:"|09|nordea-dk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nrfittj.co.cc (Malware_Distribution)"; content:"|07|nrfittj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuteye.ru (SEO_Fraud)"; content:"|06|nuteye|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nutgas.ru (SEO_Fraud)"; content:"|06|nutgas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oilmom.ru (SEO_Fraud)"; content:"|06|oilmom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oldyak.ru (SEO_Fraud)"; content:"|06|oldyak|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup padink.ru (SEO_Fraud)"; content:"|06|padink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup padmix.ru (SEO_Fraud)"; content:"|06|padmix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup padwit.ru (SEO_Fraud)"; content:"|06|padwit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paldad.ru (SEO_Fraud)"; content:"|06|paldad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panwar.ru (SEO_Fraud)"; content:"|06|panwar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pawbin.ru (SEO_Fraud)"; content:"|06|pawbin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pawego.ru (SEO_Fraud)"; content:"|06|pawego|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pawyou.ru (SEO_Fraud)"; content:"|06|pawyou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pegcan.ru (SEO_Fraud)"; content:"|06|pegcan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoshop-secretru.504.com1.ru (Malware_Distribution)"; content:"|12|photoshop-secretru|03|504|04|com1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piespa.ru (SEO_Fraud)"; content:"|06|piespa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pigegg.ru (SEO_Fraud)"; content:"|06|pigegg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pitbed.ru (SEO_Fraud)"; content:"|06|pitbed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pitegg.ru (SEO_Fraud)"; content:"|06|pitegg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pivotgolf1.com ()"; content:"|0a|pivotgolf1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup placemethere732asq.com (Zeus_Zbot_SpyEye)"; content:"|12|placemethere732asq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup podspa.ru (SEO_Fraud)"; content:"|06|podspa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pupgas.ru (SEO_Fraud)"; content:"|06|pupgas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qiaatosqyus.com (Malware_Distribution)"; content:"|0b|qiaatosqyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ragaxe.ru (SEO_Fraud)"; content:"|06|ragaxe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raptap.ru (SEO_Fraud)"; content:"|06|raptap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ratingstat.com (Malware_Distribution)"; content:"|0a|ratingstat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ribale.ru (SEO_Fraud)"; content:"|06|ribale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rimpub.ru (SEO_Fraud)"; content:"|06|rimpub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rowpen.ru (SEO_Fraud)"; content:"|06|rowpen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rowpup.ru (SEO_Fraud)"; content:"|06|rowpup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxegg.ru (SEO_Fraud)"; content:"|06|saxegg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxelf.ru (SEO_Fraud)"; content:"|06|saxelf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sayangholidays.com (Zeus_Zbot_SpyEye)"; content:"|0e|sayangholidays|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup schatzlab.org (Malware_Distribution)"; content:"|09|schatzlab|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seebun.ru (SEO_Fraud)"; content:"|06|seebun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shuvalovskiy.com (Malware_Distribution)"; content:"|0c|shuvalovskiy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soddot.ru (SEO_Fraud)"; content:"|06|soddot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sodleg.ru (SEO_Fraud)"; content:"|06|sodleg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sodtap.ru (SEO_Fraud)"; content:"|06|sodtap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonlip.ru (SEO_Fraud)"; content:"|06|sonlip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonuniigaam.in (Malware_Distribution)"; content:"|0b|sonuniigaam|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soul-you.in (Malware_Distribution)"; content:"|08|soul-you|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup speedboan.co.kr (Malware_Distribution)"; content:"|09|speedboan|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabmud.ru (SEO_Fraud)"; content:"|06|tabmud|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagbox.ru (SEO_Fraud)"; content:"|06|tagbox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagray.ru (SEO_Fraud)"; content:"|06|tagray|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tarbat.ru (SEO_Fraud)"; content:"|06|tarbat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tarkid.ru (SEO_Fraud)"; content:"|06|tarkid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tarwit.ru (SEO_Fraud)"; content:"|06|tarwit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxwit.ru (SEO_Fraud)"; content:"|06|taxwit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teaspa.ru (SEO_Fraud)"; content:"|06|teaspa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telecom-nz.yolasite.com (Malware_Distribution)"; content:"|0a|telecom-nz|08|yolasite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-hiringdivision.com (Zeus_Zbot_SpyEye)"; content:"|12|the-hiringdivision|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiebag.ru (SEO_Fraud)"; content:"|06|tiebag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tinpet.ru (SEO_Fraud)"; content:"|06|tinpet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tinpie.ru (SEO_Fraud)"; content:"|06|tinpie|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tipwit.ru (SEO_Fraud)"; content:"|06|tipwit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toekid.ru (SEO_Fraud)"; content:"|06|toekid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-boss.com.tw (Malware_Distribution)"; content:"|08|top-boss|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tratatata.co.tv (Malware_Distribution)"; content:"|09|tratatata|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trbijim.co.cc (Malware_Distribution)"; content:"|07|trbijim|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubweb.ru (SEO_Fraud)"; content:"|06|tubweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup useditwoulfur.com (Zeus_Zbot_SpyEye)"; content:"|0d|useditwoulfur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoarchive.kristenjstewart.ru (Malware_Distribution)"; content:"|0c|videoarchive|0f|kristenjstewart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidhisec.com (Malware_Distribution)"; content:"|08|vidhisec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waxsax.ru (SEO_Fraud)"; content:"|06|waxsax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wideon.co.kr (Malware_Distribution)"; content:"|06|wideon|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wigelf.ru (SEO_Fraud)"; content:"|06|wigelf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wigweb.ru (SEO_Fraud)"; content:"|06|wigweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup workree.oueb.eu (Malware_Distribution)"; content:"|07|workree|04|oueb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yazilimdenizi.com (Malware_Distribution)"; content:"|0d|yazilimdenizi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ycqdn.com (Malware_Infectors)"; content:"|05|ycqdn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zenwit.ru (SEO_Fraud)"; content:"|06|zenwit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zipfad.ru (SEO_Fraud)"; content:"|06|zipfad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zitcow.ru (SEO_Fraud)"; content:"|06|zitcow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zitlab.ru (SEO_Fraud)"; content:"|06|zitlab|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all4gsm.uni.cc (Malware_Infectors)"; content:"|07|all4gsm|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup he4hshxjhfdjh.co.cc (Malware_Distribution)"; content:"|0d|he4hshxjhfdjh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adfusionnetwork.com (Malware_Infectors)"; content:"|0f|adfusionnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adopsassistant.com (Malware_Distribution)"; content:"|0e|adopsassistant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup altuscu.net (Malware_Infectors)"; content:"|07|altuscu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ateling.com (Malware_Infectors)"; content:"|07|ateling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atorat.be (Malware_Infectors)"; content:"|06|atorat|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autocontext.begun.ru ()"; content:"|0b|autocontext|05|begun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bibiblocksberg.net (Zeus_Zbot_SpyEye)"; content:"|0e|bibiblocksberg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bkcynt.com (Malware_Infectors)"; content:"|06|bkcynt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookmonn.com (Malware_Distribution)"; content:"|08|bookmonn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulland.be (Malware_Infectors)"; content:"|07|bulland|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup claquana.com (Malware_Infectors)"; content:"|08|claquana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coergy.be (Malware_Infectors)"; content:"|06|coergy|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comoto.be ()"; content:"|06|comoto|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corebio.be (Malware_Infectors)"; content:"|07|corebio|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfrgcc.com (Malware_Distribution)"; content:"|06|dfrgcc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doubleadserver.com (Malware_Infectors)"; content:"|0e|doubleadserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evella.be (Malware_Infectors)"; content:"|06|evella|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyebluster-sv1.com (Malware_Distribution)"; content:"|0e|eyebluster-sv1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup factan.be (Malware_Infectors)"; content:"|06|factan|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feltch.be (Malware_Infectors)"; content:"|06|feltch|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fieldad.be (Malware_Infectors)"; content:"|07|fieldad|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fingewe.be ()"; content:"|07|fingewe|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup folksmu.be (Malware_Infectors)"; content:"|07|folksmu|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geoffresmith.info (Malware_Distribution)"; content:"|0c|geoffresmith|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gestex.be ()"; content:"|06|gestex|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godwiden.be (Malware_Infectors)"; content:"|08|godwiden|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup halverd.net ()"; content:"|07|halverd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happicu.be (Malware_Infectors)"; content:"|07|happicu|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hawker.be ()"; content:"|06|hawker|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hemiacy.com ()"; content:"|07|hemiacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsjwui24gg4g.com (Malware_Infectors)"; content:"|0c|hsjwui24gg4g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indiatoursback.in (Zeus_Zbot_SpyEye)"; content:"|0e|indiatoursback|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indorace.be (Malware_Infectors)"; content:"|08|indorace|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irsthb-army.rr.nu (Malware_Distribution)"; content:"|0b|irsthb-army|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kasjchseuk.com (Malware_Infectors)"; content:"|0a|kasjchseuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krexjdsamdx.com (Malware_Infectors)"; content:"|0b|krexjdsamdx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mailru-pro.com (Malware_Infectors)"; content:"|0a|mailru-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matrixmotors.org (Zeus_Zbot_SpyEye)"; content:"|0c|matrixmotors|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediamindtracking.com (Malware_Infectors)"; content:"|11|mediamindtracking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft.office-helppane.com (Zeus_Zbot_SpyEye)"; content:"|09|microsoft|0f|office-helppane|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olololo.in ()"; content:"|07|olololo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playnewf.be (Malware_Infectors)"; content:"|08|playnewf|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powieutygvbjhv4gh.com (Malware_Infectors)"; content:"|11|powieutygvbjhv4gh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppcall.begun.ru ()"; content:"|06|ppcall|05|begun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proadfine.rr.nu (Malware_Distribution)"; content:"|09|proadfine|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualynm.be ()"; content:"|07|qualynm|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rchilene.in (Malware_Infectors)"; content:"|08|rchilene|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rijkfcor.be (Malware_Infectors)"; content:"|08|rijkfcor|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riumoete.net (Malware_Infectors)"; content:"|08|riumoete|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxoid.com ()"; content:"|06|saxoid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search.sputnik1.ru ()"; content:"|06|search|08|sputnik1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sekvend.com ()"; content:"|07|sekvend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sidembo.be ()"; content:"|07|sidembo|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjdhcasla.com ()"; content:"|09|sjdhcasla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slayt.be ()"; content:"|05|slayt|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softeror.be (Malware_Infectors)"; content:"|08|softeror|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soprig.be (Malware_Infectors)"; content:"|06|soprig|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spujucbanodo.tk (Malware_Infectors)"; content:"|0c|spujucbanodo|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subjenn.be ()"; content:"|07|subjenn|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamaral.be (Malware_Infectors)"; content:"|07|tamaral|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup track0n.com (Zeus_Zbot_SpyEye)"; content:"|07|track0n|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trinali.be (Malware_Infectors)"; content:"|07|trinali|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webbi.be ()"; content:"|05|webbi|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ymail-vip.com (Malware_Infectors)"; content:"|09|ymail-vip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yonymosc.be ()"; content:"|08|yonymosc|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessgo.info (Malware_Distribution)"; content:"|0a|businessgo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12ninianasije.cx.cc (Malware_Infectors)"; content:"|0d|12ninianasije|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 28chejil.com (Malware_Distribution)"; content:"|08|28chejil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2go-inc.com (Zeus_Zbot_SpyEye)"; content:"|07|2go-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2upl.com (Malware_Distribution)"; content:"|04|2upl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6666088.com (Malware_Infectors)"; content:"|07|6666088|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 69585.com (Malware_Distribution)"; content:"|05|69585|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwordsvoorbeeld.nl (Malware_Distribution)"; content:"|10|adwordsvoorbeeld|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agapornis.fw.hu (Malware_Distribution)"; content:"|09|agapornis|02|fw|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alexeybakhtin.com (Malware_Distribution)"; content:"|0d|alexeybakhtin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alfa.sumy.ua (Malware_Distribution)"; content:"|04|alfa|04|sumy|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arryada.info (Malware_Distribution)"; content:"|07|arryada|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atlanticligh.com (Zeus_Zbot_SpyEye)"; content:"|0c|atlanticligh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-aff.biz (Fake_AV)"; content:"|06|av-aff|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awdntomvader.com (Malware_Infectors)"; content:"|0c|awdntomvader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aytjtomvader.com (Malware_Infectors)"; content:"|0c|aytjtomvader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azietek.republika.pl (Malware_Distribution)"; content:"|07|azietek|09|republika|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baylee.us (Malware_Distribution)"; content:"|06|baylee|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigmomies.com (Malware_Distribution)"; content:"|09|bigmomies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookfula.com (Malware_Distribution)"; content:"|08|bookfula|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookgusa.com (Malware_Distribution)"; content:"|08|bookgusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookmono.com (Malware_Distribution)"; content:"|08|bookmono|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookzula.com (Malware_Distribution)"; content:"|08|bookzula|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup callieandcompany.com (Malware_Distribution)"; content:"|10|callieandcompany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cgwx.info (Malware_Distribution)"; content:"|04|cgwx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chjnlcgcyus.com (Malware_Infectors)"; content:"|0b|chjnlcgcyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dierpret.nl (Malware_Distribution)"; content:"|08|dierpret|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dqv4fzs.ru (Phishing_and_Theft)"; content:"|07|dqv4fzs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightfree.ru (SEO_Fraud)"; content:"|0e|dropweightfree|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightfun.ru (SEO_Fraud)"; content:"|0d|dropweightfun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightgame.ru (SEO_Fraud)"; content:"|0e|dropweightgame|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightgames.ru (SEO_Fraud)"; content:"|0f|dropweightgames|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightgreen.ru (SEO_Fraud)"; content:"|0f|dropweightgreen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweighthealth.ru (SEO_Fraud)"; content:"|10|dropweighthealth|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweighthome.ru (SEO_Fraud)"; content:"|0e|dropweighthome|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweighthost.ru (SEO_Fraud)"; content:"|0e|dropweighthost|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweighthosting.ru (SEO_Fraud)"; content:"|11|dropweighthosting|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightinfo.ru (SEO_Fraud)"; content:"|0e|dropweightinfo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightjob.ru (SEO_Fraud)"; content:"|0d|dropweightjob|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightlife.ru (SEO_Fraud)"; content:"|0e|dropweightlife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightlink.ru (SEO_Fraud)"; content:"|0e|dropweightlink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightlove.ru (SEO_Fraud)"; content:"|0e|dropweightlove|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightmarketing.ru (SEO_Fraud)"; content:"|13|dropweightmarketing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightmedia.ru (SEO_Fraud)"; content:"|0f|dropweightmedia|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightmobile.ru (SEO_Fraud)"; content:"|10|dropweightmobile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightmoney.ru (SEO_Fraud)"; content:"|0f|dropweightmoney|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightmusic.ru (SEO_Fraud)"; content:"|0f|dropweightmusic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightnet.ru (SEO_Fraud)"; content:"|0d|dropweightnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightnews.ru (SEO_Fraud)"; content:"|0e|dropweightnews|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightonline.ru (SEO_Fraud)"; content:"|10|dropweightonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightphoto.ru (SEO_Fraud)"; content:"|0f|dropweightphoto|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightpro.ru (SEO_Fraud)"; content:"|0d|dropweightpro|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightred.ru (SEO_Fraud)"; content:"|0d|dropweightred|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightsearch.ru (SEO_Fraud)"; content:"|10|dropweightsearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ejzettk.ru (Malware_Infectors)"; content:"|07|ejzettk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup era23.cu.cc (Malware_Distribution)"; content:"|05|era23|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ermornoatos.pochta.ru (Malware_Distribution)"; content:"|0b|ermornoatos|06|pochta|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezmowerparts.com (Malware_Distribution)"; content:"|0c|ezmowerparts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-dl.com (Malware_Distribution)"; content:"|07|file-dl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finneuro.com (Zeus_Zbot_SpyEye)"; content:"|08|finneuro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flash7.co.in (Malware_Distribution)"; content:"|06|flash7|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup franksbox.000space.com (Malware_Distribution)"; content:"|09|franksbox|08|000space|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funnyextreme.net (Malware_Infectors)"; content:"|0c|funnyextreme|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gghhduy.c0m.li (Malware_Distribution)"; content:"|07|gghhduy|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghmtgmg.ru (Malware_Infectors)"; content:"|07|ghmtgmg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalcml.com (Malware_Distribution)"; content:"|09|globalcml|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldflews.info (Malware_Distribution)"; content:"|09|goldflews|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hedgefundconsultancy.com (Malware_Distribution)"; content:"|14|hedgefundconsultancy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icrafterz.com (SEO_Fraud)"; content:"|09|icrafterz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idetpemiyus.com (Malware_Infectors)"; content:"|0b|idetpemiyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igre321.com (Malware_Distribution)"; content:"|07|igre321|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqnmcnxoslapsdf.cu.cc (Malware_Distribution)"; content:"|0f|iqnmcnxoslapsdf|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jamesbond225.com (Zeus_Zbot_SpyEye)"; content:"|0c|jamesbond225|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkkjgfds.c0m.li (Malware_Distribution)"; content:"|08|jkkjgfds|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justincheah.com (Malware_Distribution)"; content:"|0b|justincheah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kogogh.com (Malware_Distribution)"; content:"|06|kogogh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kotran.net (Malware_Distribution)"; content:"|06|kotran|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lttserv.com (Malware_Distribution)"; content:"|07|lttserv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lucatme.com (Malware_Distribution)"; content:"|07|lucatme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ly20dzf.ru (Phishing_and_Theft)"; content:"|07|ly20dzf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariko7.in (Malware_Distribution)"; content:"|07|mariko7|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-tegos.wen.ru (Malware_Distribution)"; content:"|0a|mega-tegos|03|wen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myuringo.altervista.org (Malware_Distribution)"; content:"|08|myuringo|0a|altervista|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netnetnet1.com (Malware_Infectors)"; content:"|0a|netnetnet1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nobrain.dk (Malware_Distribution)"; content:"|07|nobrain|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perekopan.co.cc (Malware_Distribution)"; content:"|09|perekopan|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polskiesuki.pl (Malware_Distribution)"; content:"|0b|polskiesuki|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxcx-freex5a.ru (Phishing_and_Theft)"; content:"|10|porkaxcx-freex5a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornoclub4upornosex.ru (Malware_Infectors)"; content:"|13|pornoclub4upornosex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornoxmx-onlina5c.ru (Phishing_and_Theft)"; content:"|11|pornoxmx-onlina5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qij4obd.ru (Malware_Distribution)"; content:"|07|qij4obd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realpay.pl (Malware_Distribution)"; content:"|07|realpay|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redirecthosts.com (Zeus_Zbot_SpyEye)"; content:"|0d|redirecthosts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registry-fix-softwares.com (Malware_Distribution)"; content:"|16|registry-fix-softwares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rs-tek.com (Malware_Distribution)"; content:"|06|rs-tek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s22.bg.tf (Malware_Infectors)"; content:"|03|s22|02|bg|02|tf"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup schriock.net (Malware_Infectors)"; content:"|08|schriock|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sfs8968f6h8sf6hs80xx.com (Zeus_Zbot_SpyEye)"; content:"|14|sfs8968f6h8sf6hs80xx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup silibobo.com (Zeus_Zbot_SpyEye)"; content:"|08|silibobo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tinthethao.org (Malware_Distribution)"; content:"|0a|tinthethao|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tinyschats.com (Malware_Infectors)"; content:"|0a|tinyschats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twitterlays.com (Malware_Distribution)"; content:"|0b|twitterlays|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup udpsmedia.com (Malware_Distribution)"; content:"|09|udpsmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vampirenewsbeat.com (Malware_Infectors)"; content:"|0f|vampirenewsbeat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup velvetmedia.info (Malware_Distribution)"; content:"|0b|velvetmedia|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxcx-onlinee4c.ru (Phishing_and_Theft)"; content:"|12|videoxcx-onlinee4c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxxx-conline2b.ru (Phishing_and_Theft)"; content:"|12|videoxxx-conline2b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidosxcx-onlina5a.ru (Phishing_and_Theft)"; content:"|11|vidosxcx-onlina5a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidosxnx-freex4e.ru (Phishing_and_Theft)"; content:"|10|vidosxnx-freex4e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidosxxx-conline1a.ru (Phishing_and_Theft)"; content:"|12|vidosxxx-conline1a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viuhe.info (Malware_Infectors)"; content:"|05|viuhe|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vykyrth.ru (Phishing_and_Theft)"; content:"|07|vykyrth|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w3q.net (Malware_Distribution)"; content:"|03|w3q|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webdiz2.ru (Malware_Distribution)"; content:"|07|webdiz2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wolfvw.narod.ru (Malware_Distribution)"; content:"|06|wolfvw|05|narod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xl-hotline.com (Malware_Infectors)"; content:"|0a|xl-hotline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xwxefed.ru (Phishing_and_Theft)"; content:"|07|xwxefed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxtubes8.com (Malware_Distribution)"; content:"|09|xxxtubes8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsmokre.pl (Malware_Distribution)"; content:"|07|zsmokre|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abc-down.com (Malware_Distribution)"; content:"|08|abc-down|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abc-stats.com (Malware_Infectors)"; content:"|09|abc-stats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actbus.ru (SEO_Fraud)"; content:"|06|actbus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actionfg.com (Phishing_and_Theft)"; content:"|08|actionfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activepr.ru (Fake_AV)"; content:"|08|activepr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adena-job.com (Phishing_and_Theft)"; content:"|09|adena-job|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adenafinance.com (Phishing_and_Theft)"; content:"|0c|adenafinance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aea.org.ng (Malware_Distribution)"; content:"|03|aea|03|org|02|ng"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afggxcyayus.com (Malware_Distribution)"; content:"|0b|afggxcyayus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajhr4tgysdihfvnfgasd.com (Malware_Distribution)"; content:"|14|ajhr4tgysdihfvnfgasd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alolaway.com (Malware_Distribution)"; content:"|08|alolaway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arrowfg.com (Phishing_and_Theft)"; content:"|07|arrowfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackshades.us (Malware_Distribution)"; content:"|0b|blackshades|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centsubsgesqua.hopto.org (Malware_Distribution)"; content:"|0e|centsubsgesqua|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cifradasweb.net (Malware_Distribution)"; content:"|0b|cifradasweb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup configure4me.com (Zeus_Zbot_SpyEye)"; content:"|0c|configure4me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-fbdac.box.tl (Malware_Distribution)"; content:"|0e|defender-fbdac|03|box|02|tl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-hijcc.box.tl (Malware_Distribution)"; content:"|0e|defender-hijcc|03|box|02|tl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-hskmc.box.tl (Malware_Distribution)"; content:"|0e|defender-hskmc|03|box|02|tl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deleted-host.zapto.org (Malware_Distribution)"; content:"|0c|deleted-host|05|zapto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directconnection.altervista.org (Malware_Distribution)"; content:"|10|directconnection|0a|altervista|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightdata.ru (SEO_Fraud)"; content:"|0e|dropweightdata|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightdeal.ru (SEO_Fraud)"; content:"|0e|dropweightdeal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightdesign.ru (SEO_Fraud)"; content:"|10|dropweightdesign|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightdigital.ru (SEO_Fraud)"; content:"|11|dropweightdigital|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightdomain.ru (SEO_Fraud)"; content:"|10|dropweightdomain|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightsex.ru (SEO_Fraud)"; content:"|0d|dropweightsex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightshop.ru (SEO_Fraud)"; content:"|0e|dropweightshop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightsite.ru (SEO_Fraud)"; content:"|0e|dropweightsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightsmart.ru (SEO_Fraud)"; content:"|0f|dropweightsmart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightsoft.ru (SEO_Fraud)"; content:"|0e|dropweightsoft|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightstar.ru (SEO_Fraud)"; content:"|0e|dropweightstar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightstore.ru (SEO_Fraud)"; content:"|0f|dropweightstore|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweighttech.ru (SEO_Fraud)"; content:"|0e|dropweighttech|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweightthe.ru (SEO_Fraud)"; content:"|0d|dropweightthe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropweighttop.ru (SEO_Fraud)"; content:"|0d|dropweighttop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endoftheinternet.fileave.com (Malware_Distribution)"; content:"|10|endoftheinternet|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esdb.ae (Malware_Distribution)"; content:"|04|esdb|02|ae"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup falosfax.in (Malware_Infectors)"; content:"|08|falosfax|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fjfjhghqrkjvbiqpritiutyh.cx.cc (Malware_Distribution)"; content:"|18|fjfjhghqrkjvbiqpritiutyh|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashplayer.ctellez.com (Malware_Distribution)"; content:"|0b|flashplayer|07|ctellez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gameshirtz.com (Malware_Distribution)"; content:"|0a|gameshirtz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hbzhongtai.com (Malware_Distribution)"; content:"|0a|hbzhongtai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hepto.in (Malware_Distribution)"; content:"|05|hepto|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heroiz.net (Zeus_Zbot_SpyEye)"; content:"|06|heroiz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hire-position.com (Phishing_and_Theft)"; content:"|0d|hire-position|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoktaeder.de (Malware_Distribution)"; content:"|09|hoktaeder|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifityfocukeku.my03.com (Malware_Distribution)"; content:"|0d|ifityfocukeku|04|my03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iframeshop.net (Malware_Distribution)"; content:"|0a|iframeshop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igenorri.hopto.org (Malware_Distribution)"; content:"|08|igenorri|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illaboratoriosrl.it (Malware_Distribution)"; content:"|10|illaboratoriosrl|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabqnhijyus.com (Malware_Distribution)"; content:"|0b|jabqnhijyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jwsjyre.cx.cc (Malware_Distribution)"; content:"|07|jwsjyre|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ledelarge.fr (Malware_Distribution)"; content:"|09|ledelarge|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamkidayutvpopku.ru (Malware_Distribution)"; content:"|10|mamkidayutvpopku|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mbhvoyrhjecoke.cu.cc (Malware_Distribution)"; content:"|0e|mbhvoyrhjecoke|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meandyounow.net (Zeus_Zbot_SpyEye)"; content:"|0b|meandyounow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mijnhemubo.nl (Malware_Distribution)"; content:"|0a|mijnhemubo|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mirhandicrafts.pro.br (Malware_Distribution)"; content:"|0e|mirhandicrafts|03|pro|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mixfigschoone.com (Zeus_Zbot_SpyEye)"; content:"|0d|mixfigschoone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moreira-costa.sites.uol.com.br (Malware_Distribution)"; content:"|0d|moreira-costa|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muiebass.co.cc (Malware_Distribution)"; content:"|08|muiebass|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mwcnel.com (Malware_Distribution)"; content:"|06|mwcnel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfacejbook.com (Malware_Distribution)"; content:"|0b|myfacejbook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pics100-video.redirectme.net (Malware_Distribution)"; content:"|0d|pics100-video|0a|redirectme|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portal-factory.com (Malware_Distribution)"; content:"|0e|portal-factory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portalitinga.com.br (Malware_Distribution)"; content:"|0c|portalitinga|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puppub.ru (SEO_Fraud)"; content:"|06|puppub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pyrohost.su (Zeus_Zbot_SpyEye)"; content:"|08|pyrohost|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup santre.be (Malware_Distribution)"; content:"|06|santre|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchwink.org (Malware_Distribution)"; content:"|0a|searchwink|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchwrong.org (Malware_Distribution)"; content:"|0b|searchwrong|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shkollnitsiebutsya.ru (Malware_Distribution)"; content:"|12|shkollnitsiebutsya|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sidecom.be (Malware_Distribution)"; content:"|07|sidecom|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup so47nop.com (Zeus_Zbot_SpyEye)"; content:"|07|so47nop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solhostbass.com (Malware_Distribution)"; content:"|0b|solhostbass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyhugol.strangled.net (Zeus_Zbot_SpyEye)"; content:"|08|spyhugol|09|strangled|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superblogonline.org (Phishing_and_Theft)"; content:"|0f|superblogonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teletri.be (Malware_Distribution)"; content:"|07|teletri|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalsolutionantivirus.com (Fake_AV)"; content:"|16|totalsolutionantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trhsdevildogs.com (Malware_Distribution)"; content:"|0d|trhsdevildogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truruhfhqnviaosdpruejeslsuy.cx.cc (Malware_Infectors)"; content:"|1b|truruhfhqnviaosdpruejeslsuy|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tudorclee.com (Malware_Distribution)"; content:"|09|tudorclee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uablszeuyus.com (Malware_Distribution)"; content:"|0b|uablszeuyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubuntu-today.com (Zeus_Zbot_SpyEye)"; content:"|0c|ubuntu-today|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubuntu666box.no-ip.org (Malware_Distribution)"; content:"|0c|ubuntu666box|05|no-ip|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusthailab.com (Fake_AV)"; content:"|0c|virusthailab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wagequtn.mattemon.info (Malware_Distribution)"; content:"|08|wagequtn|08|mattemon|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waitredirect.com (Malware_Distribution)"; content:"|0c|waitredirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web307.tripod.com (Malware_Distribution)"; content:"|06|web307|06|tripod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wopeytjbsbvmve.com (Malware_Distribution)"; content:"|0e|wopeytjbsbvmve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup work-and-sex.in (Zeus_Zbot_SpyEye)"; content:"|0c|work-and-sex|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup work-position.net (Phishing_and_Theft)"; content:"|0d|work-position|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wuer1985.x.gg (Malware_Distribution)"; content:"|08|wuer1985|01|x|02|gg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyz-stats.com (Malware_Distribution)"; content:"|09|xyz-stats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yambaclick.com (Malware_Distribution)"; content:"|0a|yambaclick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yambaprivate.com (Malware_Distribution)"; content:"|0c|yambaprivate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtraveldiary.net (Phishing_and_Theft)"; content:"|0f|yourtraveldiary|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zirn-ba.ru (Malware_Distribution)"; content:"|07|zirn-ba|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zooyou.ru (SEO_Fraud)"; content:"|06|zooyou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chinabathroomshower.com (Malware_Distribution)"; content:"|13|chinabathroomshower|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup integrityworks-intl.com (Malware_Distribution)"; content:"|13|integrityworks-intl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iranblog.com ()"; content:"|08|iranblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 003zzy.com (Malware_Infectors)"; content:"|06|003zzy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 123racinggames.com (Malware_Distribution)"; content:"|0e|123racinggames|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2011-skype-software-download.com ()"; content:"|1c|2011-skype-software-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2011-skype-software-download.net ()"; content:"|1c|2011-skype-software-download|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2011-skype-software-download.org ()"; content:"|1c|2011-skype-software-download|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2011-skype-software-update.net ()"; content:"|1a|2011-skype-software-update|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2011-skype-software-upgrade.com ()"; content:"|1b|2011-skype-software-upgrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2011-skype-software-upgrade.net ()"; content:"|1b|2011-skype-software-upgrade|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2011-skype-software-upgrade.org ()"; content:"|1b|2011-skype-software-upgrade|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 263rdasd.com (Zeus_Zbot_SpyEye)"; content:"|08|263rdasd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup account-processedserv6.com (Malware_Infectors)"; content:"|16|account-processedserv6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accrisa.info (Malware_Infectors)"; content:"|07|accrisa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdsgzlayus.com (Malware_Infectors)"; content:"|0b|acdsgzlayus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admnxm.com (Phishing_and_Theft)"; content:"|06|admnxm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-acrobat-reader11.com ()"; content:"|16|adobe-acrobat-reader11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-acrobat-reader11.net ()"; content:"|16|adobe-acrobat-reader11|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-acrobat-reader11.org ()"; content:"|16|adobe-acrobat-reader11|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-acrobat11-download.com ()"; content:"|18|adobe-acrobat11-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-acrobat11-upgrade.com ()"; content:"|17|adobe-acrobat11-upgrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-pdf-reader11.com ()"; content:"|12|adobe-pdf-reader11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-pdf-reader11.net ()"; content:"|12|adobe-pdf-reader11|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-pdf-reader11.org ()"; content:"|12|adobe-pdf-reader11|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-reader11-download.com ()"; content:"|17|adobe-reader11-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-reader11-upgrade.com ()"; content:"|16|adobe-reader11-upgrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobemailer.org ()"; content:"|0b|adobemailer|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adv-statsweb.com (Malware_Infectors)"; content:"|0c|adv-statsweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advanceservicos.sites.uol.com.br (Malware_Infectors)"; content:"|0f|advanceservicos|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adxreport.com (Phishing_and_Theft)"; content:"|09|adxreport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amberbeetle.com (Malware_Infectors)"; content:"|0b|amberbeetle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup angiangphoto.com (Malware_Distribution)"; content:"|0c|angiangphoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apsentp.com (Malware_Distribution)"; content:"|07|apsentp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awesomefile.com (Malware_Distribution)"; content:"|0b|awesomefile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barcellons.com (Phishing_and_Theft)"; content:"|0a|barcellons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betononasos228.net (Phishing_and_Theft)"; content:"|0e|betononasos228|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup careerhiring-solutions.org (Phishing_and_Theft)"; content:"|16|careerhiring-solutions|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup club-bork.com (Phishing_and_Theft)"; content:"|09|club-bork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup com-watch-id2181222ooo.info (Phishing_and_Theft)"; content:"|16|com-watch-id2181222ooo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-giga.net (Phishing_and_Theft)"; content:"|0d|computer-giga|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupidwow.com (Malware_Distribution)"; content:"|08|cupidwow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup customer-data-build.com (Malware_Distribution)"; content:"|13|customer-data-build|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup data-employ.com (Malware_Distribution)"; content:"|0b|data-employ|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup data-grown.com (Malware_Distribution)"; content:"|0a|data-grown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadrandomslovostore.info (Malware_Infectors)"; content:"|18|downloadrandomslovostore|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dramchinatea.net (Phishing_and_Theft)"; content:"|0c|dramchinatea|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drubet.com (Malware_Distribution)"; content:"|06|drubet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekabu.ru (Malware_Infectors)"; content:"|05|ekabu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estatediary.com (Phishing_and_Theft)"; content:"|0b|estatediary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastblogportal.com (Malware_Distribution)"; content:"|0e|fastblogportal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findepotdirect.com (Phishing_and_Theft)"; content:"|0e|findepotdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forfreeblog.net (Phishing_and_Theft)"; content:"|0b|forfreeblog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freebloghub.com (Phishing_and_Theft)"; content:"|0b|freebloghub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeblogpro.org (Phishing_and_Theft)"; content:"|0b|freeblogpro|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freetrialmail.com (Phishing_and_Theft)"; content:"|0d|freetrialmail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshmediaportal.com (Malware_Distribution)"; content:"|10|freshmediaportal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friendsadirect.com (Phishing_and_Theft)"; content:"|0e|friendsadirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fun-bork.com (Phishing_and_Theft)"; content:"|08|fun-bork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girsland.ru (Phishing_and_Theft)"; content:"|08|girsland|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-earth.dl-labs.com (Malware_Distribution)"; content:"|0c|google-earth|07|dl-labs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostfrontpage.com (Phishing_and_Theft)"; content:"|0d|hostfrontpage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup humidworld.com (Malware_Distribution)"; content:"|0a|humidworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hushedworld.com (Malware_Distribution)"; content:"|0b|hushedworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img102.herosh.com (Malware_Distribution)"; content:"|06|img102|06|herosh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup immenseworld.com (Malware_Distribution)"; content:"|0c|immenseworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup impossible-world.com (Malware_Distribution)"; content:"|10|impossible-world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infouser-advertise.com (Malware_Distribution)"; content:"|12|infouser-advertise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intrusting-world.com (Malware_Distribution)"; content:"|10|intrusting-world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jealousworld.com (Malware_Distribution)"; content:"|0c|jealousworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jitteryworld.com (Malware_Distribution)"; content:"|0c|jitteryworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koco.biz (Malware_Distribution)"; content:"|04|koco|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krokodilius8.com (Phishing_and_Theft)"; content:"|0c|krokodilius8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastest-skype-updates.com ()"; content:"|15|lastest-skype-updates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latinitjobs.com (Phishing_and_Theft)"; content:"|0b|latinitjobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariosplace-cafe.com (Malware_Distribution)"; content:"|10|mariosplace-cafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup money-data-establish.com (Malware_Distribution)"; content:"|14|money-data-establish|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup needafishingboat.net (Phishing_and_Theft)"; content:"|10|needafishingboat|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newdownload-randomsslovo.info (Malware_Infectors)"; content:"|18|newdownload-randomsslovo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup npc-oniks.ru (Malware_Distribution)"; content:"|09|npc-oniks|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obellisk.com (Phishing_and_Theft)"; content:"|08|obellisk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-2011-skype-download.com ()"; content:"|1c|official-2011-skype-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-2011-skype-update.com ()"; content:"|1a|official-2011-skype-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-2011-skype-upgrade.com ()"; content:"|1b|official-2011-skype-upgrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-skype-download.com ()"; content:"|17|official-skype-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-skype-software.com ()"; content:"|17|official-skype-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-skype-update.com ()"; content:"|15|official-skype-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinedatingsecretfriends.com (Malware_Distribution)"; content:"|19|onlinedatingsecretfriends|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ouroldfriends.com (Phishing_and_Theft)"; content:"|0d|ouroldfriends|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pickfonts.com (Malware_Distribution)"; content:"|09|pickfonts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portalant.com (SEO_Fraud)"; content:"|09|portalant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup publicacionesglobales.com (Malware_Distribution)"; content:"|15|publicacionesglobales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realsoftwaredevelopment.com (Malware_Distribution)"; content:"|17|realsoftwaredevelopment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recruitarrowfg.com (Phishing_and_Theft)"; content:"|0e|recruitarrowfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup resetmymemory.com (Malware_Distribution)"; content:"|0d|resetmymemory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup resetservonline.com (Malware_Distribution)"; content:"|0f|resetservonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveatlasshruggedomslovo.info (Malware_Infectors)"; content:"|18|saveatlasshruggedomslovo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchfindauthorize.org (SEO_Fraud)"; content:"|13|searchfindauthorize|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-paypage.com (SEO_Fraud)"; content:"|0e|secure-paypage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securebilling-page.com (SEO_Fraud)"; content:"|12|securebilling-page|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securepaypage.com (SEO_Fraud)"; content:"|0d|securepaypage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sedonahyperbarics.com (Malware_Distribution)"; content:"|11|sedonahyperbarics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skype-software-downloads.com ()"; content:"|18|skype-software-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skype-software-downloads.net ()"; content:"|18|skype-software-downloads|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skype-software-downloads.org ()"; content:"|18|skype-software-downloads|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skypemailer.com ()"; content:"|0b|skypemailer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slowstatus.net (Phishing_and_Theft)"; content:"|0a|slowstatus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tab-g.com (Malware_Distribution)"; content:"|05|tab-g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trialreg.com (Phishing_and_Theft)"; content:"|08|trialreg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uniquefraud.org (Malware_Distribution)"; content:"|0b|uniquefraud|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup user-financedata-buy.com (Malware_Distribution)"; content:"|14|user-financedata-buy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup userdata-distribute.com (Malware_Distribution)"; content:"|13|userdata-distribute|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup users-accept-data.com (Malware_Distribution)"; content:"|11|users-accept-data|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup users-info-build.com (Malware_Distribution)"; content:"|10|users-info-build|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vincent-world.com (Malware_Distribution)"; content:"|0d|vincent-world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wapcco.net (Phishing_and_Theft)"; content:"|06|wapcco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup workasite.com (Phishing_and_Theft)"; content:"|09|workasite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldmotoblo.com (Malware_Distribution)"; content:"|0c|worldmotoblo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwapps-ups.org (Malware_Distribution)"; content:"|0b|wwwapps-ups|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--72czpba6a2at4cwaa9bxczc9k4e.com (Malware_Distribution)"; content:"|1f|xn--72czpba6a2at4cwaa9bxczc9k4e|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yerelim.com (Malware_Distribution)"; content:"|07|yerelim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zdesestvareznezahodi.com (Malware_Distribution)"; content:"|14|zdesestvareznezahodi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zhaonb.com (Malware_Distribution)"; content:"|06|zhaonb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zina.freetcp.com (Malware_Distribution)"; content:"|04|zina|07|freetcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acessoriajpt.com (Phishing_and_Theft)"; content:"|0c|acessoriajpt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ambercada.com (Malware_Infectors)"; content:"|09|ambercada|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ambercricket.com (Malware_Infectors)"; content:"|0c|ambercricket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amberhopper.com (Malware_Infectors)"; content:"|0b|amberhopper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anexo-hs.co.nu (Phishing_and_Theft)"; content:"|08|anexo-hs|02|co|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babblebus.com (Malware_Infectors)"; content:"|09|babblebus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babblecore.com (Malware_Infectors)"; content:"|0a|babblecore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babbledisk.com (Malware_Infectors)"; content:"|0a|babbledisk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babblefiber.com (Malware_Infectors)"; content:"|0b|babblefiber|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babblesink.com (Malware_Infectors)"; content:"|0a|babblesink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bittique.com (Malware_Infectors)"; content:"|08|bittique|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blacksecurityscan.com (SEO_Fraud)"; content:"|11|blacksecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bricesearch.org (SEO_Fraud)"; content:"|0b|bricesearch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buzzteria.com (Malware_Infectors)"; content:"|09|buzzteria|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cacadutrees.com (Malware_Infectors)"; content:"|0b|cacadutrees|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cam2and.ru (Phishing_and_Theft)"; content:"|07|cam2and|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chairorbitnzo.com (Zeus_Zbot_SpyEye)"; content:"|0d|chairorbitnzo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup circlemill.com (Malware_Infectors)"; content:"|0a|circlemill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citingsecurity.com (SEO_Fraud)"; content:"|0e|citingsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickpaint.org (SEO_Fraud)"; content:"|0a|clickpaint|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickpot.org (SEO_Fraud)"; content:"|08|clickpot|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clicksecurityscan.com (SEO_Fraud)"; content:"|11|clicksecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comadssearch.org (SEO_Fraud)"; content:"|0c|comadssearch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolsecurityscan.com (SEO_Fraud)"; content:"|10|coolsecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cretonol.com (Botnet_C&C)"; content:"|08|cretonol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyanhopper.com (Malware_Infectors)"; content:"|0a|cyanhopper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyanhornet.com (Malware_Infectors)"; content:"|0a|cyanhornet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyanmite.com (Malware_Infectors)"; content:"|08|cyanmite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dc237.4shared.com (Malware_Infectors)"; content:"|05|dc237|07|4shared|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup definsearch.org (SEO_Fraud)"; content:"|0b|definsearch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easysecurityscan.com (SEO_Fraud)"; content:"|10|easysecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enggraduat.com (SEO_Fraud)"; content:"|0a|enggraduat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup engspellin.com (SEO_Fraud)"; content:"|0a|engspellin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup engsummary.com (SEO_Fraud)"; content:"|0a|engsummary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eqj0uih.ru (Phishing_and_Theft)"; content:"|07|eqj0uih|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eveinoutfind.org (SEO_Fraud)"; content:"|0c|eveinoutfind|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgliqbf.ru (Phishing_and_Theft)"; content:"|07|fgliqbf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesecurityscan.com (SEO_Fraud)"; content:"|10|filesecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finance-approve-australia.com (Malware_Distribution)"; content:"|19|finance-approve-australia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findbackdup.org (SEO_Fraud)"; content:"|0b|findbackdup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderaco.org (SEO_Fraud)"; content:"|09|finderaco|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderats.org (SEO_Fraud)"; content:"|09|finderats|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderdea.org (SEO_Fraud)"; content:"|09|finderdea|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderdir.org (SEO_Fraud)"; content:"|09|finderdir|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderdow.org (SEO_Fraud)"; content:"|09|finderdow|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderexup.org (SEO_Fraud)"; content:"|0a|finderexup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findersta.org (SEO_Fraud)"; content:"|09|findersta|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderunt.org (SEO_Fraud)"; content:"|09|finderunt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderwid.org (SEO_Fraud)"; content:"|09|finderwid|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderyel.org (SEO_Fraud)"; content:"|09|finderyel|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findesten.org (SEO_Fraud)"; content:"|09|findesten|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findeupbant.org (SEO_Fraud)"; content:"|0b|findeupbant|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findextinc.org (SEO_Fraud)"; content:"|0a|findextinc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findexttab.org (SEO_Fraud)"; content:"|0a|findexttab|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findincese.org (SEO_Fraud)"; content:"|0a|findincese|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findindbi.org (SEO_Fraud)"; content:"|09|findindbi|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findinsid.org (SEO_Fraud)"; content:"|09|findinsid|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findlineinc.org (SEO_Fraud)"; content:"|0b|findlineinc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findnextinc.org (SEO_Fraud)"; content:"|0b|findnextinc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findrasup.org (SEO_Fraud)"; content:"|09|findrasup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findreup.org (SEO_Fraud)"; content:"|08|findreup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findsecurityscan.com (SEO_Fraud)"; content:"|10|findsecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findupsot.org (SEO_Fraud)"; content:"|09|findupsot|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gefferson_luiz.sites.uol.com.br (Malware_Infectors)"; content:"|0e|gefferson_luiz|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getcanfind.org (SEO_Fraud)"; content:"|0a|getcanfind|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getenjoyment.net (Phishing_and_Theft)"; content:"|0c|getenjoyment|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godaddy-updates.com (Phishing_and_Theft)"; content:"|0f|godaddy-updates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotsuspended.cn (SEO_Fraud)"; content:"|0c|gotsuspended|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup graycolor.co.kr (Spyware)"; content:"|09|graycolor|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gubeenl.ru (Phishing_and_Theft)"; content:"|07|gubeenl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l7da.net (Malware_Infectors)"; content:"|04|l7da|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lcstudies.ru (Malware_Infectors)"; content:"|09|lcstudies|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lojasmya.net (Malware_Infectors)"; content:"|08|lojasmya|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lpbromfman.sites.uol.com.br (Malware_Infectors)"; content:"|0a|lpbromfman|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lrv9utd.ru (Phishing_and_Theft)"; content:"|07|lrv9utd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lsv6dud.ru (Phishing_and_Theft)"; content:"|07|lsv6dud|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miniwidget.co.kr (Spyware)"; content:"|0a|miniwidget|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monkeytrurap.com (Malware_Infectors)"; content:"|0c|monkeytrurap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morhesto.com (Zeus_Zbot_SpyEye)"; content:"|08|morhesto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ndeourhnyus.com (Malware_Infectors)"; content:"|0b|ndeourhnyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nsoxr.info (Malware_Infectors)"; content:"|05|nsoxr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oa2rjzf.ru (Phishing_and_Theft)"; content:"|07|oa2rjzf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdeefdwpyus.com (Malware_Infectors)"; content:"|0b|pdeefdwpyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phytonordeste.sites.uol.com.br (Malware_Infectors)"; content:"|0d|phytonordeste|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxcx-onlinee5f.ru (Phishing_and_Theft)"; content:"|12|porkaxcx-onlinee5f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxnx-freex2b.ru (Phishing_and_Theft)"; content:"|10|porkaxnx-freex2b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxnx-onlina1e.ru (Phishing_and_Theft)"; content:"|11|porkaxnx-onlina1e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxnx-onlinee4h.ru (Phishing_and_Theft)"; content:"|12|porkaxnx-onlinee4h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornoxmx-onlinee1d.ru (Phishing_and_Theft)"; content:"|12|pornoxmx-onlinee1d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornoxnx-onlinee5a.ru (Phishing_and_Theft)"; content:"|12|pornoxnx-onlinee5a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privacyn.com (Spyware)"; content:"|08|privacyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qcdjqlbqyus.com (Malware_Infectors)"; content:"|0b|qcdjqlbqyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ranulfogomes.sites.uol.com.br (Malware_Infectors)"; content:"|0c|ranulfogomes|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selenszx.co.cc (Spyware)"; content:"|08|selenszx|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serokfukisp.ru (Zeus_Zbot_SpyEye)"; content:"|0b|serokfukisp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sghhhrasyus.com (Malware_Infectors)"; content:"|0b|sghhhrasyus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup srggyj.instanthq.com (Malware_Infectors)"; content:"|06|srggyj|09|instanthq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starcpdservices.com (Malware_Infectors)"; content:"|0f|starcpdservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamfidelidadedevantagens.rel7.com (Phishing_and_Theft)"; content:"|18|tamfidelidadedevantagens|04|rel7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tkugjkghagvjhmeqwfbnjhudf.cx.cc (Zeus_Zbot_SpyEye)"; content:"|19|tkugjkghagvjhmeqwfbnjhudf|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup validols.com (Zeus_Zbot_SpyEye)"; content:"|08|validols|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbigotjhtghgqldspfutyhg.cx.cc (Zeus_Zbot_SpyEye)"; content:"|17|vbigotjhtghgqldspfutyhg|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxcx-conline5a.ru (Phishing_and_Theft)"; content:"|12|videoxcx-conline5a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxxx-onlina1c.ru (Phishing_and_Theft)"; content:"|11|videoxxx-onlina1c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidosxmx-onlinee3g.ru (Phishing_and_Theft)"; content:"|12|vidosxmx-onlinee3g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wbappm.com (Spyware)"; content:"|06|wbappm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gib-uk.biz (Malware_Distribution)"; content:"|06|gib-uk|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alvinconsulting.com (Phishing_and_Theft)"; content:"|0f|alvinconsulting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amsbuk.com ()"; content:"|06|amsbuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arnbaer-gmbh.com (Phishing_and_Theft)"; content:"|0c|arnbaer-gmbh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aryakhazar.com ()"; content:"|0a|aryakhazar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astroconsulting-careers.com (Phishing_and_Theft)"; content:"|17|astroconsulting-careers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astroconsulting-jobs.com (Phishing_and_Theft)"; content:"|14|astroconsulting-jobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astroconsulting.net (Phishing_and_Theft)"; content:"|0f|astroconsulting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astroconsultingcareers.com (Phishing_and_Theft)"; content:"|16|astroconsultingcareers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astroconsultingjobs.com (Phishing_and_Theft)"; content:"|13|astroconsultingjobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astroconsultingservice.com (Phishing_and_Theft)"; content:"|16|astroconsultingservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astroconsultingsolutions.com (Phishing_and_Theft)"; content:"|18|astroconsultingsolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bartus-umzuege.de (Botnet_C&C)"; content:"|0e|bartus-umzuege|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belkonvert.net (Phishing_and_Theft)"; content:"|0a|belkonvert|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biatudl.net ()"; content:"|07|biatudl|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blwhois.com (Zeus_Zbot_SpyEye)"; content:"|07|blwhois|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brunowitz-gmbh.com (Phishing_and_Theft)"; content:"|0e|brunowitz-gmbh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bz5s.ic.cz (Malware_Distribution)"; content:"|04|bz5s|02|ic|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canalcountryartisans.net (Phishing_and_Theft)"; content:"|14|canalcountryartisans|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup careers-at-astroconsulting.com (Phishing_and_Theft)"; content:"|1a|careers-at-astroconsulting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup careers-at-osmond.com (Phishing_and_Theft)"; content:"|11|careers-at-osmond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup consulting-osmond.com (Phishing_and_Theft)"; content:"|11|consulting-osmond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erokatan.com (Zeus_Zbot_SpyEye)"; content:"|08|erokatan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evaznama.com ()"; content:"|08|evaznama|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyeblasterpixel.com (Malware_Distribution)"; content:"|0f|eyeblasterpixel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fattyvideos.com (Malware_Distribution)"; content:"|0b|fattyvideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup film-2-streaming.tv ()"; content:"|10|film-2-streaming|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstlibertybank.net (Fake_AV)"; content:"|10|firstlibertybank|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashpokerist.ru (Zeus_Zbot_SpyEye)"; content:"|0d|flashpokerist|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flymazyar.ir ()"; content:"|09|flymazyar|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forppp.net (Malware_Distribution)"; content:"|06|forppp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum.pnuit.ir ()"; content:"|05|forum|05|pnuit|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giacint.com.ua (Botnet_C&C)"; content:"|07|giacint|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-maps-advert.com (Malware_Distribution)"; content:"|12|google-maps-advert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greendownload.net ()"; content:"|0d|greendownload|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hansmuff-gmbh.com (Phishing_and_Theft)"; content:"|0d|hansmuff-gmbh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup henrywerner-gmbh.com (Phishing_and_Theft)"; content:"|10|henrywerner-gmbh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homelandsecurity-newyork.com (Malware_Distribution)"; content:"|18|homelandsecurity-newyork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homelikefeel.com (Malware_Distribution)"; content:"|0c|homelikefeel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horstzotz-gmbh.com (Phishing_and_Theft)"; content:"|0e|horstzotz-gmbh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostgozar.com ()"; content:"|09|hostgozar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyazdani.com ()"; content:"|08|hyazdani|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iprofit.su (Malware_Distribution)"; content:"|07|iprofit|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iranloveline.com ()"; content:"|0c|iranloveline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iranscarpet.ir ()"; content:"|0b|iranscarpet|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivoobst-gmbh.com (Phishing_and_Theft)"; content:"|0c|ivoobst-gmbh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacobmuntz-gmbh.com (Phishing_and_Theft)"; content:"|0f|jacobmuntz-gmbh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jahromskate.com ()"; content:"|0b|jahromskate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jimm-master.ru ()"; content:"|0b|jimm-master|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobs-astroconsulting.com (Phishing_and_Theft)"; content:"|14|jobs-astroconsulting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobs-at-astroconsulting.com (Phishing_and_Theft)"; content:"|17|jobs-at-astroconsulting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobs-at-osmond.com (Phishing_and_Theft)"; content:"|0e|jobs-at-osmond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobsat-osmond.com (Phishing_and_Theft)"; content:"|0d|jobsat-osmond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kazmishop.com (Malware_Distribution)"; content:"|09|kazmishop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kindteens.com (Phishing_and_Theft)"; content:"|09|kindteens|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kool-planet.com (Botnet_C&C)"; content:"|0b|kool-planet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkshekon.co.cc (Malware_Distribution)"; content:"|0a|linkshekon|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magerfest.ru (Malware_Distribution)"; content:"|09|magerfest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megagsm.ir ()"; content:"|07|megagsm|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memarkade.ir ()"; content:"|09|memarkade|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miavkenmmcp.com (Malware_Infectors)"; content:"|0b|miavkenmmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup music2music2.us ()"; content:"|0c|music2music2|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-guests.ru ()"; content:"|09|my-guests|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naughtywifefa.com (Phishing_and_Theft)"; content:"|0d|naughtywifefa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netso.ir ()"; content:"|05|netso|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newmyguests.ru ()"; content:"|0b|newmyguests|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nikandata.com ()"; content:"|09|nikandata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noorjam.net ()"; content:"|07|noorjam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns01.us (Malware_Distribution)"; content:"|04|ns01|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oab-mg.com (Malware_Infectors)"; content:"|06|oab-mg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orgkomitet.net (Phishing_and_Theft)"; content:"|0a|orgkomitet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osmond-careers.com (Phishing_and_Theft)"; content:"|0e|osmond-careers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osmond-consulting-jobs.com (Phishing_and_Theft)"; content:"|16|osmond-consulting-jobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osmond-consulting.com (Phishing_and_Theft)"; content:"|11|osmond-consulting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osmond-jobs.com (Phishing_and_Theft)"; content:"|0b|osmond-jobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osmondcareers.com (Phishing_and_Theft)"; content:"|0d|osmondcareers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osmondjobs.com (Phishing_and_Theft)"; content:"|0a|osmondjobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oua-corporate.com (Phishing_and_Theft)"; content:"|0d|oua-corporate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ourbigbooklibrarry.com (Spyware)"; content:"|12|ourbigbooklibrarry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paycheckinaction.com (Malware_Infectors)"; content:"|10|paycheckinaction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcplus.or.kr (Malware_Infectors)"; content:"|06|pcplus|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup persianfarmers.com ()"; content:"|0e|persianfarmers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pey2.co.cc (Malware_Distribution)"; content:"|04|pey2|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pickviewonline.com (Spyware)"; content:"|0e|pickviewonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player-992746.com (Malware_Distribution)"; content:"|0d|player-992746|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnuit.ir ()"; content:"|05|pnuit|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouyakam.com ()"; content:"|08|pouyakam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouyakam.ir ()"; content:"|08|pouyakam|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pytalhost.de (Malware_Distribution)"; content:"|09|pytalhost|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qerfhgkadhsfukhertgrpotgjpoidfg.ce.ms (Malware_Distribution)"; content:"|1f|qerfhgkadhsfukhertgrpotgjpoidfg|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ranzball.w2c.ru (Malware_Distribution)"; content:"|08|ranzball|03|w2c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rap-dooni.org ()"; content:"|09|rap-dooni|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rasadata.com ()"; content:"|08|rasadata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalflooring.ca (Malware_Distribution)"; content:"|0d|royalflooring|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtt8.com (Malware_Distribution)"; content:"|04|rtt8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchhearthealth.com (Malware_Distribution)"; content:"|11|searchhearthealth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shervinet.com ()"; content:"|09|shervinet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shervinethost.com ()"; content:"|0d|shervinethost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skanara.com ()"; content:"|07|skanara|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smsoboroten.ru ()"; content:"|0b|smsoboroten|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smszilla.ru ()"; content:"|08|smszilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup songir.com ()"; content:"|06|songir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spas2012.in (Malware_Distribution)"; content:"|08|spas2012|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storeordersonline.com (Spyware)"; content:"|11|storeordersonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suojiaoge.com (Malware_Distribution)"; content:"|09|suojiaoge|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swall.ru ()"; content:"|05|swall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tak2net.com ()"; content:"|07|tak2net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uildawindturbine.ce.ms (Malware_Distribution)"; content:"|10|uildawindturbine|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unshavedcuties.com (Malware_Distribution)"; content:"|0e|unshavedcuties|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usdownload.in ()"; content:"|0a|usdownload|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup useac.net (Phishing_and_Theft)"; content:"|05|useac|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidosxmx-onlina1e.ru (Malware_Distribution)"; content:"|11|vidosxmx-onlina1e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup view.binlayer.com (Malware_Distribution)"; content:"|04|view|08|binlayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vitoldbraun-gmbh.com (Phishing_and_Theft)"; content:"|10|vitoldbraun-gmbh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkontakte-id.com (Phishing_and_Theft)"; content:"|0c|vkontakte-id|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vksprut.com ()"; content:"|07|vksprut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webprofiler.cc ()"; content:"|0b|webprofiler|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wushuassociation.org ()"; content:"|10|wushuassociation|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ww038.com (Malware_Distribution)"; content:"|05|ww038|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z165284.infobox.ru (Malware_Distribution)"; content:"|07|z165284|07|infobox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaolist.ru (Phishing_and_Theft)"; content:"|07|zaolist|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zbestprice.org (Malware_Distribution)"; content:"|0a|zbestprice|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aljalea.net (Malware_Distribution)"; content:"|07|aljalea|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 10s-the-best.tk (Malware_Distribution)"; content:"|0c|10s-the-best|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 140inv.com (Malware_Distribution)"; content:"|06|140inv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3534.in (Malware_Infectors)"; content:"|04|3534|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 38secretov.ru ()"; content:"|0a|38secretov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4efeffeer.ce.ms (Malware_Infectors)"; content:"|09|4efeffeer|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 54608baba.in (Zeus_Zbot_SpyEye)"; content:"|09|54608baba|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 634rfeds.com (Zeus_Zbot_SpyEye)"; content:"|08|634rfeds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abra.ce.ms (Malware_Distribution)"; content:"|04|abra|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup account.skype.com.up7.us (Malware_Distribution)"; content:"|07|account|05|skype|03|com|03|up7|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup achivplatz.com (Malware_Distribution)"; content:"|0a|achivplatz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adultchatro.info (Malware_Distribution)"; content:"|0b|adultchatro|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aefqkkjamcp.com (Malware_Infectors)"; content:"|0b|aefqkkjamcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup animerocket.net (Malware_Distribution)"; content:"|0b|animerocket|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atribux.com (Malware_Distribution)"; content:"|07|atribux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bejb883-njm.com (Malware_Distribution)"; content:"|0b|bejb883-njm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsecurityrav.rr.nu (Malware_Infectors)"; content:"|0f|bestsecurityrav|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brazzers-gratuit.com (Malware_Distribution)"; content:"|10|brazzers-gratuit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bustdy.in (Malware_Infectors)"; content:"|06|bustdy|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bwghat.com (Malware_Distribution)"; content:"|06|bwghat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bxwqxlkp4ajt.com (Malware_Distribution)"; content:"|0c|bxwqxlkp4ajt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdcdcd.ce.ms (Malware_Infectors)"; content:"|06|cdcdcd|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contractlinksecurityorganizationsdnbhd.com (Phishing_and_Theft)"; content:"|26|contractlinksecurityorganizationsdnbhd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxcqw.ce.ms (Malware_Infectors)"; content:"|05|cxcqw|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dark-hosting.net (Malware_Distribution)"; content:"|0c|dark-hosting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darkice-gaming.info (Malware_Distribution)"; content:"|0e|darkice-gaming|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derhvbq.ce.ms (Malware_Distribution)"; content:"|07|derhvbq|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dribscool.com (Malware_Distribution)"; content:"|09|dribscool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecran-de-veille.org (Malware_Distribution)"; content:"|0f|ecran-de-veille|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eponim.mk (Malware_Distribution)"; content:"|06|eponim|02|mk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erenerdogan.com.tr (Malware_Distribution)"; content:"|0b|erenerdogan|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyebllaster.com (Malware_Distribution)"; content:"|0b|eyebllaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup family.mobwork.net (Malware_Distribution)"; content:"|06|family|07|mobwork|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feeew0r-geek.com (Malware_Distribution)"; content:"|0c|feeew0r-geek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmproduction-eldi.com (Malware_Distribution)"; content:"|13|filmproduction-eldi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup first-atlanticbank.com (Fake_AV)"; content:"|12|first-atlanticbank|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstgrscanner.rr.nu (Malware_Infectors)"; content:"|0e|firstgrscanner|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdeaaxrgmcp.com (Malware_Infectors)"; content:"|0b|gdeaaxrgmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdgdhjjdcbqgdsiutrg.ce.ms (Malware_Infectors)"; content:"|13|gdgdhjjdcbqgdsiutrg|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gghxfdpgmcp.com (Malware_Infectors)"; content:"|0b|gghxfdpgmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gic-kbmtu0zkvwylf.com (Malware_Infectors)"; content:"|11|gic-kbmtu0zkvwylf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gosti-vk.ru ()"; content:"|08|gosti-vk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gostimoi.ru ()"; content:"|08|gostimoi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gostivkontakte.ru ()"; content:"|0e|gostivkontakte|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guestsvk.ru ()"; content:"|08|guestsvk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gv47numkmkmfub8790.com (Malware_Distribution)"; content:"|12|gv47numkmkmfub8790|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgajskfgkewrfgyjagysdf.ce.ms (Malware_Infectors)"; content:"|16|hgajskfgkewrfgyjagysdf|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhnnbtcnotcf3ohtxt.com (Malware_Distribution)"; content:"|12|hhnnbtcnotcf3ohtxt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyrzxm.cn (Malware_Distribution)"; content:"|06|hyrzxm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup it-jobsearch.com (Phishing_and_Theft)"; content:"|0c|it-jobsearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j5dlz7rxoto8g1fubb.com (Malware_Distribution)"; content:"|12|j5dlz7rxoto8g1fubb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jblextyhsfqttkz.com (Malware_Distribution)"; content:"|0f|jblextyhsfqttkz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhv684ybknjkm.com (Malware_Distribution)"; content:"|0d|jhv684ybknjkm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjghui.com (Malware_Infectors)"; content:"|06|jjghui|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpmorganchasenewyork.com (Fake_AV)"; content:"|14|jpmorganchasenewyork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kamasgold.com ()"; content:"|09|kamasgold|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keter-jankinsome.com (Malware_Distribution)"; content:"|10|keter-jankinsome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kghxfhpkmcp.com (Malware_Infectors)"; content:"|0b|kghxfhpkmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiabkdskmcp.com (Malware_Infectors)"; content:"|0b|kiabkdskmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labufajahhs.com (Malware_Distribution)"; content:"|0b|labufajahhs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liberty-live.ru (Malware_Distribution)"; content:"|0c|liberty-live|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linexasafe.rr.nu (Malware_Infectors)"; content:"|0a|linexasafe|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lol0gcj.ru (Phishing_and_Theft)"; content:"|07|lol0gcj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maininishop.it (Malware_Distribution)"; content:"|0b|maininishop|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marocsong.net ()"; content:"|09|marocsong|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mefgkrxmmcp.com (Malware_Infectors)"; content:"|0b|mefgkrxmmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meflkxdmmcp.com (Malware_Infectors)"; content:"|0b|meflkxdmmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mefvkbnmmcp.com (Malware_Infectors)"; content:"|0b|mefvkbnmmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minidvdsoft.com (Malware_Distribution)"; content:"|0b|minidvdsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motomanual.com.ar (Malware_Distribution)"; content:"|0a|motomanual|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musiqwap.com ()"; content:"|08|musiqwap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup narutoget.tv ()"; content:"|09|narutoget|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup natwestbk-uk.org (Fake_AV)"; content:"|0c|natwestbk-uk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-jobaccess.com (Phishing_and_Theft)"; content:"|0d|new-jobaccess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsroom-mpls.net (Malware_Distribution)"; content:"|0d|newsroom-mpls|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oidjrkjcmnnjdffhhdhv.ce.ms (Malware_Infectors)"; content:"|14|oidjrkjcmnnjdffhhdhv|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-filmek.hu ()"; content:"|0d|online-filmek|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlyteenz.net ()"; content:"|09|onlyteenz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onmusix.com ()"; content:"|07|onmusix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palacsintarecept.info ()"; content:"|10|palacsintarecept|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxnx-onlina3b.ru (Phishing_and_Theft)"; content:"|11|porkaxnx-onlina3b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornoxxx-onlina3g.ru (Phishing_and_Theft)"; content:"|11|pornoxxx-onlina3g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup power-iymaster.rr.nu (Malware_Infectors)"; content:"|0e|power-iymaster|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pysk.co.cc (Malware_Infectors)"; content:"|04|pysk|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q9-e52wjh7cz.com (Malware_Distribution)"; content:"|0c|q9-e52wjh7cz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qhjypbqqmcp.com (Malware_Infectors)"; content:"|0b|qhjypbqqmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r67m5h.ce.ms (Malware_Distribution)"; content:"|06|r67m5h|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rats-crew.info ()"; content:"|09|rats-crew|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup runefx.com ()"; content:"|06|runefx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safebrowser.in (Spyware)"; content:"|0b|safebrowser|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safebrowsing.ru (Spyware)"; content:"|0c|safebrowsing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeidksoft.rr.nu (Malware_Infectors)"; content:"|0b|safeidksoft|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sassgutfv.com (Malware_Infectors)"; content:"|09|sassgutfv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shencosheriff.com (Zeus_Zbot_SpyEye)"; content:"|0d|shencosheriff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simple-jobneed.com (Phishing_and_Theft)"; content:"|0e|simple-jobneed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-scanereq.in (Malware_Infectors)"; content:"|0e|smart-scanereq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strongdefenseiz.in (Malware_Infectors)"; content:"|0f|strongdefenseiz|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titledrutty.org (Malware_Distribution)"; content:"|0b|titledrutty|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toiletarchway.org (Malware_Distribution)"; content:"|0d|toiletarchway|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torturetactful.org (Malware_Distribution)"; content:"|0e|torturetactful|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totaltwelfth.org (Malware_Distribution)"; content:"|0c|totaltwelfth|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficgarland.org (Malware_Distribution)"; content:"|0e|trafficgarland|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trashnote.org (Malware_Distribution)"; content:"|09|trashnote|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trickleivy.org (Malware_Distribution)"; content:"|0a|trickleivy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trivialappears.org (Malware_Distribution)"; content:"|0e|trivialappears|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tualette.ce.ms (Malware_Infectors)"; content:"|08|tualette|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tunebask.org (Malware_Distribution)"; content:"|08|tunebask|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turbidworship.org (Malware_Distribution)"; content:"|0d|turbidworship|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tvshka.ce.ms (Malware_Infectors)"; content:"|06|tvshka|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup undoingperfect.org (Malware_Distribution)"; content:"|0e|undoingperfect|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unduedome.org (Malware_Distribution)"; content:"|09|unduedome|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unibkgh.com ()"; content:"|07|unibkgh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updates-ms.com (Fake_AV)"; content:"|0a|updates-ms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utbadjl.ce.ms (Malware_Distribution)"; content:"|07|utbadjl|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxxx-conline1c.ru (Phishing_and_Theft)"; content:"|12|videoxxx-conline1c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxxx-freex3e.ru (Phishing_and_Theft)"; content:"|10|videoxxx-freex3e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsabhymw.ce.ms (Malware_Infectors)"; content:"|08|vsabhymw|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wedanthem.org (Malware_Distribution)"; content:"|09|wedanthem|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wettrend.org (Malware_Distribution)"; content:"|08|wettrend|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whimperchart.org (Malware_Distribution)"; content:"|0c|whimperchart|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup widowerfeeble.org (Malware_Distribution)"; content:"|0d|widowerfeeble|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wikiioc.com (Malware_Distribution)"; content:"|07|wikiioc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wivestemple.org (Malware_Distribution)"; content:"|0b|wivestemple|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woecake.org (Malware_Distribution)"; content:"|07|woecake|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woverecruit.org (Malware_Distribution)"; content:"|0b|woverecruit|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wretchninny.org (Malware_Distribution)"; content:"|0b|wretchninny|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xnyiinobfb.ce.ms (Malware_Distribution)"; content:"|0a|xnyiinobfb|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xped.us ()"; content:"|04|xped|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xt918.com ()"; content:"|05|xt918|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zippuny.org (Malware_Distribution)"; content:"|07|zippuny|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dancespotlightusa.com (Malware_Distribution)"; content:"|11|dancespotlightusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 345.pl (Malware_Distribution)"; content:"|03|345|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acclaimpump.org (Malware_Distribution)"; content:"|0b|acclaimpump|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdepnvamcp.com (Malware_Infectors)"; content:"|0b|acdepnvamcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acha-online.com (Malware_Infectors)"; content:"|0b|acha-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acreafloat.org (Malware_Distribution)"; content:"|0a|acreafloat|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeroadore.org (Malware_Distribution)"; content:"|09|aeroadore|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup affairmedley.org (Malware_Distribution)"; content:"|0c|affairmedley|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afraiddown.org (Malware_Distribution)"; content:"|0a|afraiddown|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup againindorse.org (Malware_Distribution)"; content:"|0c|againindorse|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alertworsted.org (Malware_Distribution)"; content:"|0c|alertworsted|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazzamboni.sites.uol.com.br (Malware_Infectors)"; content:"|0b|amazzamboni|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analyseshort.org (Malware_Distribution)"; content:"|0c|analyseshort|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup andam1.webphoto.ir (Malware_Distribution)"; content:"|06|andam1|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ao9z.com (Malware_Infectors)"; content:"|04|ao9z|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ardorloathe.org (Malware_Distribution)"; content:"|0b|ardorloathe|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arenda3213.ce.ms (Malware_Distribution)"; content:"|0a|arenda3213|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arraigngarment.org (Malware_Distribution)"; content:"|0e|arraigngarment|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arulbrothers.com (Malware_Infectors)"; content:"|0c|arulbrothers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assortsetto.org (Malware_Distribution)"; content:"|0b|assortsetto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asyueu37yhd.com (Malware_Distribution)"; content:"|0b|asyueu37yhd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atlanticafilms.com (Zeus_Zbot_SpyEye)"; content:"|0e|atlanticafilms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bakedemure.org (Malware_Distribution)"; content:"|0a|bakedemure|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestcouponshere.com ()"; content:"|0f|bestcouponshere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigcherrybox.com (Malware_Distribution)"; content:"|0c|bigcherrybox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billyfuns.net (Malware_Distribution)"; content:"|09|billyfuns|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blazed.maximum-irc.info (Malware_Infectors)"; content:"|06|blazed|0b|maximum-irc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bon-shop.allforyou.at (Malware_Infectors)"; content:"|08|bon-shop|09|allforyou|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxtaditp.com (Zeus_Zbot_SpyEye)"; content:"|09|boxtaditp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brazilianmoney2011.ru (Malware_Distribution)"; content:"|12|brazilianmoney2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cb-google-analytics.ru ()"; content:"|13|cb-google-analytics|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cc-google-analytics.ru ()"; content:"|13|cc-google-analytics|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ce-google-analytics.ru ()"; content:"|13|ce-google-analytics|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cf-google-analytics.ru ()"; content:"|13|cf-google-analytics|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cherrychat.ru (Malware_Distribution)"; content:"|0a|cherrychat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cidamiquelim.sites.uol.com.br (Malware_Infectors)"; content:"|0c|cidamiquelim|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coferpaltda.sites.uol.com.br (Malware_Infectors)"; content:"|0b|coferpaltda|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup communityspace2911.ru (Malware_Distribution)"; content:"|12|communityspace2911|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corsinogomes.sites.uol.com.br (Malware_Infectors)"; content:"|0c|corsinogomes|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coupon-one.com ()"; content:"|0a|coupon-one|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpsystms.com (Malware_Infectors)"; content:"|08|cpsystms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup czechmoney2011.ru (Malware_Distribution)"; content:"|0e|czechmoney2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darkwarez.pl (Phishing_and_Theft)"; content:"|09|darkwarez|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolcekomarenoro2011.ru (Malware_Distribution)"; content:"|13|dolcekomarenoro2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downcontent.ru (Malware_Distribution)"; content:"|0b|downcontent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-filesall.ru (Malware_Distribution)"; content:"|11|download-filesall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-filesget.ru (Malware_Distribution)"; content:"|11|download-filesget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-search-house.ru (Malware_Distribution)"; content:"|15|download-search-house|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadfilesget.ru (Malware_Distribution)"; content:"|10|downloadfilesget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadhouse-moment.ru (Malware_Distribution)"; content:"|14|downloadhouse-moment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadlotshouse.ru (Malware_Distribution)"; content:"|11|downloadlotshouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadmoment-search.ru (Malware_Distribution)"; content:"|15|downloadmoment-search|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadpoiskfiles.ru (Malware_Distribution)"; content:"|12|downloadpoiskfiles|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadstuff-find.ru (Malware_Distribution)"; content:"|12|downloadstuff-find|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dtreklam.in (Malware_Distribution)"; content:"|08|dtreklam|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-casher.ru (Malware_Distribution)"; content:"|08|e-casher|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-loadmob.ru (Malware_Distribution)"; content:"|09|e-loadmob|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eapillsvr.ru (Malware_Distribution)"; content:"|09|eapillsvr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eminence-global.com (Zeus_Zbot_SpyEye)"; content:"|0f|eminence-global|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etsaweb.org (Malware_Distribution)"; content:"|07|etsaweb|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup falcononfly2006.ru (Malware_Distribution)"; content:"|0f|falcononfly2006|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastresource.in (Malware_Distribution)"; content:"|0c|fastresource|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fff-tools.com (Zeus_Zbot_SpyEye)"; content:"|09|fff-tools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-all-moment.ru (Malware_Distribution)"; content:"|0f|file-all-moment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-all-search.ru (Malware_Distribution)"; content:"|0f|file-all-search|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-file-find.ru (Malware_Distribution)"; content:"|0e|file-file-find|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-file-stuff.ru (Malware_Distribution)"; content:"|0f|file-file-stuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-fileall.ru (Malware_Distribution)"; content:"|0c|file-fileall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-find-download.ru (Malware_Distribution)"; content:"|12|file-find-download|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-get-moment.ru (Malware_Distribution)"; content:"|0f|file-get-moment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-gethouse.ru (Malware_Distribution)"; content:"|0d|file-gethouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-getsearch.ru (Malware_Distribution)"; content:"|0e|file-getsearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firewallmakeover.ru (Malware_Distribution)"; content:"|10|firewallmakeover|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fly-fff.com (Zeus_Zbot_SpyEye)"; content:"|07|fly-fff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flyforfine.com (Zeus_Zbot_SpyEye)"; content:"|0a|flyforfine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup footporntube.com (Malware_Distribution)"; content:"|0c|footporntube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forsalga102.ru (Malware_Distribution)"; content:"|0b|forsalga102|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gavni.usa.cc (Malware_Distribution)"; content:"|05|gavni|03|usa|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gethappysamples.net (Malware_Distribution)"; content:"|0f|gethappysamples|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globaltechweb.no-ip.org (Malware_Infectors)"; content:"|0d|globaltechweb|05|no-ip|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gonewb.ddns.ms (Zeus_Zbot_SpyEye)"; content:"|06|gonewb|04|ddns|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guano.ce.ms (Malware_Distribution)"; content:"|05|guano|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happyhom.co.kr (Malware_Infectors)"; content:"|08|happyhom|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huyechek.com (Malware_Infectors)"; content:"|08|huyechek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup im.blazin-irc.info (Malware_Infectors)"; content:"|02|im|0a|blazin-irc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2655999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innovativesocial.net (Malware_Distribution)"; content:"|10|innovativesocial|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inspector-gadgets.com (Zeus_Zbot_SpyEye)"; content:"|11|inspector-gadgets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irc.alphairc.com (Malware_Infectors)"; content:"|03|irc|08|alphairc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jad3.ru (Zeus_Zbot_SpyEye)"; content:"|04|jad3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jcdtpmljmcp.com (Malware_Infectors)"; content:"|0b|jcdtpmljmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jmesmd.com (Malware_Distribution)"; content:"|06|jmesmd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobtrue.ru (Malware_Distribution)"; content:"|07|jobtrue|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kasperskychk.dyndns.org ()"; content:"|0c|kasperskychk|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kchohensee.com (Zeus_Zbot_SpyEye)"; content:"|0a|kchohensee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup landofskillsdr.net (Malware_Distribution)"; content:"|0e|landofskillsdr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loitercash.org (Malware_Distribution)"; content:"|0a|loitercash|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup longingashamed.org (Malware_Distribution)"; content:"|0e|longingashamed|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotsarchivsearch.ru (Malware_Distribution)"; content:"|10|lotsarchivsearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotsdownloadmoment.ru (Malware_Distribution)"; content:"|12|lotsdownloadmoment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotsfile-files.ru (Malware_Distribution)"; content:"|0e|lotsfile-files|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotsget-find.ru (Malware_Distribution)"; content:"|0c|lotsget-find|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotspoiskhouse.ru (Malware_Distribution)"; content:"|0e|lotspoiskhouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotssearch-find.ru (Malware_Distribution)"; content:"|0f|lotssearch-find|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotssearch-get.ru (Malware_Distribution)"; content:"|0e|lotssearch-get|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lowlymeaty.org (Malware_Distribution)"; content:"|0a|lowlymeaty|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lowsnooze.org (Malware_Distribution)"; content:"|09|lowsnooze|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maniashow.org (Malware_Distribution)"; content:"|09|maniashow|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup many-all-moment.ru (Malware_Distribution)"; content:"|0f|many-all-moment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup many-archiv-file.ru (Malware_Distribution)"; content:"|10|many-archiv-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup many-downloadpoisk.ru (Malware_Distribution)"; content:"|12|many-downloadpoisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup many-filesget.ru (Malware_Distribution)"; content:"|0d|many-filesget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manyall-get.ru (Malware_Distribution)"; content:"|0b|manyall-get|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manyallpoisk.ru (Malware_Distribution)"; content:"|0c|manyallpoisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manyarchiv-all.ru (Malware_Distribution)"; content:"|0e|manyarchiv-all|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manyarchivstuff.ru (Malware_Distribution)"; content:"|0f|manyarchivstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup map789.com (Botnet_C&C)"; content:"|06|map789|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mashscamp.org (Malware_Distribution)"; content:"|09|mashscamp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masterwarez.no-ip.org (Malware_Infectors)"; content:"|0b|masterwarez|05|no-ip|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max5clock.net (Malware_Distribution)"; content:"|09|max5clock|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maximumnone.org (Malware_Distribution)"; content:"|0b|maximumnone|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mbcsfckmmcp.com (Malware_Infectors)"; content:"|0b|mbcsfckmmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicychs.ru (Malware_Distribution)"; content:"|09|medicychs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicycly.ru (Malware_Distribution)"; content:"|09|medicycly|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicycot.ru (Malware_Distribution)"; content:"|09|medicycot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicynit.ru (Malware_Distribution)"; content:"|09|medicynit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memoirsmatrix.org (Malware_Distribution)"; content:"|0d|memoirsmatrix|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mepills.ru (Malware_Distribution)"; content:"|07|mepills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meslefot.com (Zeus_Zbot_SpyEye)"; content:"|08|meslefot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miabkvsmmcp.com (Malware_Infectors)"; content:"|0b|miabkvsmmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milletavoid.org (Malware_Distribution)"; content:"|0b|milletavoid|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miserytenure.org (Malware_Distribution)"; content:"|0c|miserytenure|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modernbin.org (Malware_Distribution)"; content:"|09|modernbin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moment-downloadget.ru (Malware_Distribution)"; content:"|12|moment-downloadget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moment-file-find.ru (Malware_Distribution)"; content:"|10|moment-file-find|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moment-getall.ru (Malware_Distribution)"; content:"|0d|moment-getall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moment-housefind.ru (Malware_Distribution)"; content:"|10|moment-housefind|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneykeep2011.ru (Malware_Distribution)"; content:"|0d|moneykeep2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneymgmt2011.ru (Malware_Distribution)"; content:"|0d|moneymgmt2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msmsms8.blazin-irc.info (Malware_Infectors)"; content:"|07|msmsms8|0a|blazin-irc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naxnax.ce.ms (Malware_Distribution)"; content:"|06|naxnax|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ncsplus.com (Malware_Distribution)"; content:"|07|ncsplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obcsfnkomcp.com (Malware_Infectors)"; content:"|0b|obcsfnkomcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohjopfgomcp.com (Malware_Infectors)"; content:"|0b|ohjopfgomcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oilsintetyc.ru (Malware_Distribution)"; content:"|0b|oilsintetyc|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ortho4u.com (Malware_Infectors)"; content:"|07|ortho4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ownership-online.com (Zeus_Zbot_SpyEye)"; content:"|10|ownership-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup philippinemoney2011.ru (Malware_Distribution)"; content:"|13|philippinemoney2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pizaniraybolt.sites.uol.com.br (Malware_Infectors)"; content:"|0d|pizaniraybolt|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxmx-onlina3g.ru (Phishing_and_Theft)"; content:"|11|porkaxmx-onlina3g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portagas.com (Zeus_Zbot_SpyEye)"; content:"|08|portagas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pownedcoupons.com ()"; content:"|0d|pownedcoupons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qscwd.com (Malware_Distribution)"; content:"|05|qscwd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relax-tropicana.ru (Malware_Infectors)"; content:"|0f|relax-tropicana|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sausagesments.com (Malware_Distribution)"; content:"|0d|sausagesments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sefqkxjsmcp.com (Malware_Infectors)"; content:"|0b|sefqkxjsmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serch-iteration.com (Malware_Distribution)"; content:"|0f|serch-iteration|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoping-cards.com (Zeus_Zbot_SpyEye)"; content:"|0d|shoping-cards|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-corporation.ru (Malware_Distribution)"; content:"|10|soft-corporation|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup splatteringfaces.com (Malware_Distribution)"; content:"|10|splatteringfaces|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sshd.dyndns.tv (Malware_Infectors)"; content:"|04|sshd|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuntedvote.org (Malware_Distribution)"; content:"|0b|stuntedvote|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subdueshone.org (Malware_Distribution)"; content:"|0b|subdueshone|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suctionbanking.org (Malware_Distribution)"; content:"|0e|suctionbanking|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitebillion.org (Malware_Distribution)"; content:"|0c|suitebillion|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunnyscythe.org (Malware_Distribution)"; content:"|0b|sunnyscythe|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superbhotbed.org (Malware_Distribution)"; content:"|0c|superbhotbed|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systmsd.com (Malware_Infectors)"; content:"|07|systmsd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taintfurl.org (Malware_Distribution)"; content:"|09|taintfurl|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup talkerrun.org (Malware_Distribution)"; content:"|09|talkerrun|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tasteleg.org (Malware_Distribution)"; content:"|08|tasteleg|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tensionwarble.org (Malware_Distribution)"; content:"|0d|tensionwarble|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testradiant.org (Malware_Distribution)"; content:"|0b|testradiant|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-serials.com (Malware_Infectors)"; content:"|0b|the-serials|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolbarqueries-google.info (Malware_Distribution)"; content:"|15|toolbarqueries-google|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torreandaluz.com (Malware_Distribution)"; content:"|0c|torreandaluz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackerlohaaa.in (Zeus_Zbot_SpyEye)"; content:"|0d|trackerlohaaa|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic.maximum-irc.info (Malware_Infectors)"; content:"|07|traffic|0b|maximum-irc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tylt9avnpfl-zdk.com (Malware_Distribution)"; content:"|0f|tylt9avnpfl-zdk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uh-i99ur3qa9t3ssw.com (Malware_Distribution)"; content:"|11|uh-i99ur3qa9t3ssw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upsbkschmajhlxs6.com (Malware_Distribution)"; content:"|10|upsbkschmajhlxs6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vazqqef.ru (Malware_Infectors)"; content:"|07|vazqqef|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbhw53jnjjn00o.com (Malware_Distribution)"; content:"|0e|vbhw53jnjjn00o|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vedroskofun.com (Malware_Distribution)"; content:"|0b|vedroskofun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxnx-onlinee3h.ru (Phishing_and_Theft)"; content:"|12|videoxnx-onlinee3h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidosxmx-conline5e.ru (Phishing_and_Theft)"; content:"|12|vidosxmx-conline5e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vzrnb4o4.com (Zeus_Zbot_SpyEye)"; content:"|08|vzrnb4o4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warlikedisobey.org (Malware_Distribution)"; content:"|0e|warlikedisobey|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web.mlep.com (Malware_Distribution)"; content:"|03|web|04|mlep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiekf533.info (Malware_Infectors)"; content:"|08|wiekf533|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x24l0jpdhtccng-ojw.com (Malware_Distribution)"; content:"|12|x24l0jpdhtccng-ojw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcxmjb2joopypo.com (Malware_Distribution)"; content:"|0e|xcxmjb2joopypo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmlnetwork.in (Malware_Distribution)"; content:"|0a|xmlnetwork|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zhfg0l5eijw4tjxc.com (Malware_Distribution)"; content:"|10|zhfg0l5eijw4tjxc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zw5kfhmujx024saj2.com (Malware_Distribution)"; content:"|11|zw5kfhmujx024saj2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 123-img.com ()"; content:"|07|123-img|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3hosts.info (Malware_Distribution)"; content:"|06|3hosts|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.cuu.cc (Malware_Infectors)"; content:"|02|ad|03|cuu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.dzw.tv ()"; content:"|02|ad|03|dzw|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.fnb.cc ()"; content:"|02|ad|03|fnb|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.lsurocksoc.com ()"; content:"|02|ad|0a|lsurocksoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.nce.name ()"; content:"|02|ad|03|nce|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.of.cm ()"; content:"|02|ad|02|of|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.row.name ()"; content:"|02|ad|03|row|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.sge.me ()"; content:"|02|ad|03|sge|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.topweightlossadvice.com ()"; content:"|02|ad|13|topweightlossadvice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.zeg.cc ()"; content:"|02|ad|03|zeg|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads.chester-le-street-asc.org ()"; content:"|03|ads|15|chester-le-street-asc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afpillsvr.ru (Malware_Distribution)"; content:"|09|afpillsvr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alapali.com (Malware_Distribution)"; content:"|07|alapali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-archivsearch.ru (Malware_Distribution)"; content:"|10|all-archivsearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-filessearch.ru (Malware_Distribution)"; content:"|0f|all-filessearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-findmoment.ru (Malware_Distribution)"; content:"|0e|all-findmoment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-getdownload.ru (Malware_Distribution)"; content:"|0f|all-getdownload|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amiadrugaddict.info (Malware_Distribution)"; content:"|0e|amiadrugaddict|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arnelles.dyndns.tv ()"; content:"|08|arnelles|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b0.assetcollect.com ()"; content:"|02|b0|0c|assetcollect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup balloontroops.org (Malware_Distribution)"; content:"|0d|balloontroops|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baskettubular.org (Malware_Distribution)"; content:"|0d|baskettubular|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbwcandylicious.com ()"; content:"|0f|bbwcandylicious|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beandown.org (Malware_Distribution)"; content:"|08|beandown|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedridpollute.org (Malware_Distribution)"; content:"|0d|bedridpollute|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benttopple.org (Malware_Distribution)"; content:"|0a|benttopple|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bequestramble.org (Malware_Distribution)"; content:"|0d|bequestramble|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best2banners.com ()"; content:"|0c|best2banners|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blazefiddle.org (Malware_Distribution)"; content:"|0b|blazefiddle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blisswilds.org (Malware_Distribution)"; content:"|0a|blisswilds|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boardbutts.org (Malware_Distribution)"; content:"|0a|boardbutts|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bringgreed.org (Malware_Distribution)"; content:"|0a|bringgreed|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunkscamp.org (Malware_Distribution)"; content:"|09|bunkscamp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burntbrought.org (Malware_Distribution)"; content:"|0c|burntbrought|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup butchermeetm.org (Malware_Distribution)"; content:"|0c|butchermeetm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bywordtoll.org (Malware_Distribution)"; content:"|0a|bywordtoll|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cackleshaggy.org (Malware_Distribution)"; content:"|0c|cackleshaggy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capsuletrapeze.org (Malware_Distribution)"; content:"|0e|capsuletrapeze|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carptheirs.org (Malware_Distribution)"; content:"|0a|carptheirs|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cellarprank.org (Malware_Distribution)"; content:"|0b|cellarprank|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cellchin.org (Malware_Distribution)"; content:"|08|cellchin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cementshout.org (Malware_Distribution)"; content:"|0b|cementshout|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup choreuphold.org (Malware_Distribution)"; content:"|0b|choreuphold|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clamourunion.org (Malware_Distribution)"; content:"|0c|clamourunion|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup classiclily.org (Malware_Distribution)"; content:"|0b|classiclily|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clerkinure.org (Malware_Distribution)"; content:"|0a|clerkinure|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cloudaway.com ()"; content:"|09|cloudaway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comechirp.org (Malware_Distribution)"; content:"|09|comechirp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crafttexture.org (Malware_Distribution)"; content:"|0c|crafttexture|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup damaskslab.org (Malware_Distribution)"; content:"|0a|damaskslab|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darkbdsmlinks.com ()"; content:"|0d|darkbdsmlinks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup declaimtaunt.org (Malware_Distribution)"; content:"|0c|declaimtaunt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decreecattle.org (Malware_Distribution)"; content:"|0c|decreecattle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delayabrige.org (Malware_Distribution)"; content:"|0b|delayabrige|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup descentesociale.freeiz.com (Malware_Distribution)"; content:"|0f|descentesociale|06|freeiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desisthateful.org (Malware_Distribution)"; content:"|0d|desisthateful|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deskoccur.org (Malware_Distribution)"; content:"|09|deskoccur|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup devoidshed.org (Malware_Distribution)"; content:"|0a|devoidshed|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dimsadden.org (Malware_Distribution)"; content:"|09|dimsadden|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dirttouchy.org (Malware_Distribution)"; content:"|0a|dirttouchy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discernpitcher.org (Malware_Distribution)"; content:"|0e|discernpitcher|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup divingpeddle.org (Malware_Distribution)"; content:"|0c|divingpeddle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotingbouquet.org (Malware_Distribution)"; content:"|0d|dotingbouquet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drunkgaysexparty.com ()"; content:"|10|drunkgaysexparty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsjkkwlhhdd.com (Zeus_Zbot_SpyEye)"; content:"|0b|dsjkkwlhhdd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e46l.cc ()"; content:"|04|e46l|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eclipsedensity.org (Malware_Distribution)"; content:"|0e|eclipsedensity|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup economyjersey.org (Malware_Distribution)"; content:"|0d|economyjersey|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elateexample.org (Malware_Distribution)"; content:"|0c|elateexample|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elkrecline.org (Malware_Distribution)"; content:"|0a|elkrecline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup embraceniece.org (Malware_Distribution)"; content:"|0c|embraceniece|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enigmaflutter.org (Malware_Distribution)"; content:"|0d|enigmaflutter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enjoyocean.org (Malware_Distribution)"; content:"|0a|enjoyocean|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enrolcaw.org (Malware_Distribution)"; content:"|08|enrolcaw|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estril.org (Malware_Distribution)"; content:"|06|estril|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eventliving.org (Malware_Distribution)"; content:"|0b|eventliving|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evermist.org (Malware_Distribution)"; content:"|08|evermist|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exclusive-pretens.net ()"; content:"|11|exclusive-pretens|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyescanty.org (Malware_Distribution)"; content:"|09|eyescanty|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facingsinvade.org (Malware_Distribution)"; content:"|0d|facingsinvade|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup factionchurch.org (Malware_Distribution)"; content:"|0d|factionchurch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fallacypour.org (Malware_Distribution)"; content:"|0b|fallacypour|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fangwrath.org (Malware_Distribution)"; content:"|09|fangwrath|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgg-ltd.ru (Malware_Distribution)"; content:"|07|fgg-ltd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiancesardine.org (Malware_Distribution)"; content:"|0d|fiancesardine|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileshat.com ()"; content:"|08|fileshat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum-cs.net76.net (Malware_Distribution)"; content:"|08|forum-cs|05|net76|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gayhermes.com ()"; content:"|09|gayhermes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdsghqyfxskng.ce.ms (Malware_Distribution)"; content:"|0d|gdsghqyfxskng|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-file-poisk.ru (Malware_Infectors)"; content:"|0e|get-file-poisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analutics.com ()"; content:"|10|google-analutics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analysis.com ()"; content:"|0f|google-analysis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorycup.ru (SEO_Fraud)"; content:"|07|gorycup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1c4.net (Malware_Infectors)"; content:"|04|h1c4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h46r.com ()"; content:"|04|h46r|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup health-seller.com ()"; content:"|0d|health-seller|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heuropa.dyndns.tv ()"; content:"|07|heuropa|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holzgau.dyndns.tv ()"; content:"|07|holzgau|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horewdt.com (Malware_Distribution)"; content:"|07|horewdt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iffind.com ()"; content:"|06|iffind|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifsearch.in ()"; content:"|08|ifsearch|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup junesommerlivev.com (Malware_Distribution)"; content:"|0f|junesommerlivev|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leokretro-af.cz.cc (Malware_Distribution)"; content:"|0c|leokretro-af|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lestifashion.com ()"; content:"|0c|lestifashion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livingradiantly.com (Malware_Distribution)"; content:"|0f|livingradiantly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m29m.in ()"; content:"|04|m29m|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medictins.ru (Malware_Distribution)"; content:"|09|medictins|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medictioi.ru (Malware_Distribution)"; content:"|09|medictioi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicturm.ru (Malware_Distribution)"; content:"|09|medicturm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicturr.ru (Malware_Distribution)"; content:"|09|medicturr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicubee.ru (Malware_Distribution)"; content:"|09|medicubee|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicubim.ru (Malware_Distribution)"; content:"|09|medicubim|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediculam.ru (Malware_Distribution)"; content:"|09|mediculam|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediculdo.ru (Malware_Distribution)"; content:"|09|mediculdo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicushu.ru (Malware_Distribution)"; content:"|09|medicushu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicviet.ru (Malware_Distribution)"; content:"|09|medicviet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicviru.ru (Malware_Distribution)"; content:"|09|medicviru|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicxti.ru (Malware_Distribution)"; content:"|08|medicxti|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicxue.ru (Malware_Distribution)"; content:"|08|medicxue|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicxul.ru (Malware_Distribution)"; content:"|08|medicxul|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicxvi.ru (Malware_Distribution)"; content:"|08|medicxvi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup merchant.aegispayments.com ()"; content:"|08|merchant|0d|aegispayments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meridianjo.dyndns.tv ()"; content:"|0a|meridianjo|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup model-seil.ru (Malware_Distribution)"; content:"|0a|model-seil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moment-manylots.ru (Malware_Distribution)"; content:"|0f|moment-manylots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moment-poisksearch.ru (Malware_Distribution)"; content:"|12|moment-poisksearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moment-stuffall.ru (Malware_Distribution)"; content:"|0f|moment-stuffall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momentarchivhouse.ru (Malware_Distribution)"; content:"|11|momentarchivhouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momentarchivstuff.ru (Malware_Distribution)"; content:"|11|momentarchivstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momentdownload-lots.ru (Malware_Distribution)"; content:"|13|momentdownload-lots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momentdownloadall.ru (Malware_Distribution)"; content:"|11|momentdownloadall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momentfile-all.ru (Malware_Distribution)"; content:"|0e|momentfile-all|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momentlotsstuff.ru (Malware_Distribution)"; content:"|0f|momentlotsstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motionritm.ru (Malware_Distribution)"; content:"|0a|motionritm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mytdsssss.info ()"; content:"|09|mytdsssss|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nasty.dyndns.tv ()"; content:"|05|nasty|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newswf.com ()"; content:"|06|newswf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nxtgipo.org (Malware_Infectors)"; content:"|07|nxtgipo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup od1.cz.cc (Malware_Distribution)"; content:"|03|od1|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osiki.osa.pl (Malware_Distribution)"; content:"|05|osiki|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ost1b.info (Malware_Infectors)"; content:"|05|ost1b|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup papertulip.ru (Zeus_Zbot_SpyEye)"; content:"|0a|papertulip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paradoxnet.in (Botnet_C&C)"; content:"|0a|paradoxnet|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pentagori.com ()"; content:"|09|pentagori|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfotec.net76.net (Malware_Distribution)"; content:"|08|perfotec|05|net76|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piclick.in ()"; content:"|07|piclick|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plumcrazy-media.net (Malware_Distribution)"; content:"|0f|plumcrazy-media|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polerdaco.net ()"; content:"|09|polerdaco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pop.5spuds.com ()"; content:"|03|pop|06|5spuds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pop.lolitastorm.co.uk ()"; content:"|03|pop|0b|lolitastorm|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup project-soustr.net76.net (Malware_Distribution)"; content:"|0e|project-soustr|05|net76|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptp.tycreative.co.uk ()"; content:"|03|ptp|0a|tycreative|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retgen-rasch12.com (Malware_Distribution)"; content:"|0e|retgen-rasch12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retno-uhb3.com (Malware_Distribution)"; content:"|0a|retno-uhb3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rijeguni.co.tv (Malware_Distribution)"; content:"|08|rijeguni|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robogxgp.dyndns.tv ()"; content:"|08|robogxgp|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robohckt.dyndns.tv ()"; content:"|08|robohckt|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robohwfo.dyndns.tv ()"; content:"|08|robohwfo|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roboidlu.dyndns.tv ()"; content:"|08|roboidlu|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robojemv.dyndns.tv ()"; content:"|08|robojemv|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robooiqz.dyndns.tv ()"; content:"|08|robooiqz|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robopdmv.dyndns.tv ()"; content:"|08|robopdmv|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roboqenw.dyndns.tv ()"; content:"|08|roboqenw|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rzncgorop-yvpx.com (Malware_Distribution)"; content:"|0e|rzncgorop-yvpx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samsusams.net (Malware_Distribution)"; content:"|09|samsusams|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sandoulov.com (Malware_Infectors)"; content:"|09|sandoulov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secaviable.ru (Malware_Distribution)"; content:"|0a|secaviable|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.checkout-amazon.com (Phishing_and_Theft)"; content:"|06|secure|0f|checkout-amazon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sharki.osa.pl (Malware_Distribution)"; content:"|06|sharki|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shgkgwgkls.com (Zeus_Zbot_SpyEye)"; content:"|0a|shgkgwgkls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shouldfasten.org (Malware_Distribution)"; content:"|0c|shouldfasten|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sinnerreflex.org (Malware_Distribution)"; content:"|0c|sinnerreflex|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sirsize.org (Malware_Distribution)"; content:"|07|sirsize|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skimlyrical.org (Malware_Distribution)"; content:"|0b|skimlyrical|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skytux-tv.dyndns.tv ()"; content:"|09|skytux-tv|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slopestipend.org (Malware_Distribution)"; content:"|0c|slopestipend|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sorrelramble.org (Malware_Distribution)"; content:"|0c|sorrelramble|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sortirka.osa.pl (Malware_Distribution)"; content:"|08|sortirka|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sprutnetwork.com (Malware_Distribution)"; content:"|0c|sprutnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup squealflirt.org (Malware_Distribution)"; content:"|0b|squealflirt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sshwklwjen.com (Zeus_Zbot_SpyEye)"; content:"|0a|sshwklwjen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup staideconomy.org (Malware_Distribution)"; content:"|0c|staideconomy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starryplank.org (Malware_Distribution)"; content:"|0b|starryplank|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats.jstats.us ()"; content:"|05|stats|06|jstats|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats.piclab.us ()"; content:"|05|stats|06|piclab|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statsfun.com ()"; content:"|08|statsfun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stowgranary.org (Malware_Distribution)"; content:"|0b|stowgranary|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stripescud.org (Malware_Distribution)"; content:"|0a|stripescud|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup studentfairly.org (Malware_Distribution)"; content:"|0d|studentfairly|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuffwrestle.org (Malware_Distribution)"; content:"|0c|stuffwrestle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys.no-ip.net ()"; content:"|03|sys|05|no-ip|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tb.wdecompany.com ()"; content:"|02|tb|0a|wdecompany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup televaksa.dyndns.tv ()"; content:"|09|televaksa|06|dyndns|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timelymaze.org (Malware_Distribution)"; content:"|0a|timelymaze|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trusiki.345.pl (Malware_Distribution)"; content:"|07|trusiki|03|345|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unitepulpit.org (Malware_Distribution)"; content:"|0b|unitepulpit|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unshipreckon.org (Malware_Distribution)"; content:"|0c|unshipreckon|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usapornotube.com (Malware_Distribution)"; content:"|0c|usapornotube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usheronce.org (Malware_Distribution)"; content:"|09|usheronce|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vp29uud.ru (Malware_Distribution)"; content:"|07|vp29uud|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weaktrash.ru (Zeus_Zbot_SpyEye)"; content:"|09|weaktrash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wouufo.allalla.com (Phishing_and_Theft)"; content:"|06|wouufo|07|allalla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youtimeyob.com (Zeus_Zbot_SpyEye)"; content:"|0a|youtimeyob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 19runs10q3.com (Malware_Distribution)"; content:"|0a|19runs10q3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2waky.com (Malware_Distribution)"; content:"|05|2waky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 77xxmm.cn (Malware_Distribution)"; content:"|06|77xxmm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajcprhwvp.cx.cc ()"; content:"|09|ajcprhwvp|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup augustow.pl (Malware_Distribution)"; content:"|08|augustow|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup australia-verse.com (Botnet_C&C)"; content:"|0f|australia-verse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blurayeol.com ()"; content:"|09|blurayeol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookvivi.com (Malware_Distribution)"; content:"|08|bookvivi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxprint.qipim.ru (Malware_Distribution)"; content:"|08|boxprint|05|qipim|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brentnallfg.com (SEO_Fraud)"; content:"|0b|brentnallfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buycheapvcc.com ()"; content:"|0b|buycheapvcc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chk4me.com (Fake_AV)"; content:"|06|chk4me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cinderella-dreams.org ()"; content:"|11|cinderella-dreams|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanwaters.sites.uol.com.br (Malware_Distribution)"; content:"|0b|cleanwaters|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dskjhiukwlw.com (Zeus_Zbot_SpyEye)"; content:"|0b|dskjhiukwlw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup financialactivson.com (SEO_Fraud)"; content:"|11|financialactivson|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstrtscaner.rr.nu (Malware_Distribution)"; content:"|0d|firstrtscaner|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fishingbeet.org (Malware_Distribution)"; content:"|0b|fishingbeet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flaxnap.org (Malware_Distribution)"; content:"|07|flaxnap|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foggystudent.org (Malware_Distribution)"; content:"|0c|foggystudent|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foresttruck.org (Malware_Distribution)"; content:"|0b|foresttruck|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuzzoffal.org (Malware_Distribution)"; content:"|09|fuzzoffal|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gailyflounce.org (Malware_Distribution)"; content:"|0c|gailyflounce|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gazettesay.org (Malware_Distribution)"; content:"|0a|gazettesay|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghatlend.org (Malware_Distribution)"; content:"|08|ghatlend|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghatreds.org (Malware_Distribution)"; content:"|08|ghatreds|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gibbetshook.org (Malware_Distribution)"; content:"|0b|gibbetshook|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gladespilt.org (Malware_Distribution)"; content:"|0a|gladespilt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godliketourist.org (Malware_Distribution)"; content:"|0e|godliketourist|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodantics.org (Malware_Distribution)"; content:"|0a|goodantics|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gostivk.ru ()"; content:"|07|gostivk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grandetidings.org (Malware_Distribution)"; content:"|0d|grandetidings|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greathell.ru ()"; content:"|09|greathell|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grenadeabove.org (Malware_Distribution)"; content:"|0c|grenadeabove|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gruver.org (Malware_Distribution)"; content:"|06|gruver|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gulpillegal.org (Malware_Distribution)"; content:"|0b|gulpillegal|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup halcyonet.com (Malware_Distribution)"; content:"|09|halcyonet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hamcadet.org (Malware_Distribution)"; content:"|08|hamcadet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heronuntrue.org (Malware_Distribution)"; content:"|0b|heronuntrue|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhho1.ce.ms ()"; content:"|05|hhho1|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hideousmindful.org (Malware_Distribution)"; content:"|0e|hideousmindful|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hillocksaunter.org (Malware_Distribution)"; content:"|0e|hillocksaunter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iliri-rks.com ()"; content:"|09|iliri-rks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infocenc.com.br (Malware_Distribution)"; content:"|08|infocenc|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itchysauce.ru ()"; content:"|0a|itchysauce|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itemizefir.org (Malware_Distribution)"; content:"|0a|itemizefir|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jarabroad.org (Malware_Distribution)"; content:"|09|jarabroad|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javatooltip.com (Malware_Distribution)"; content:"|0b|javatooltip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jewishdin.org (Malware_Distribution)"; content:"|09|jewishdin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jfjfhfyhuqnbnciper.cz.cc ()"; content:"|12|jfjfhfyhuqnbnciper|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhgukn.com (Malware_Distribution)"; content:"|06|jhgukn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jocularputrefy.org (Malware_Distribution)"; content:"|0e|jocularputrefy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jstooltip.com (Malware_Distribution)"; content:"|09|jstooltip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juicecaulk.org (Malware_Distribution)"; content:"|0a|juicecaulk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justlysubtle.org (Malware_Distribution)"; content:"|0c|justlysubtle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kalmup.org (Malware_Distribution)"; content:"|06|kalmup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kinoutlaw.org (Malware_Distribution)"; content:"|09|kinoutlaw|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lambkinclad.org (Malware_Distribution)"; content:"|0b|lambkinclad|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laundrysudden.org (Malware_Distribution)"; content:"|0d|laundrysudden|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leanspeck.org (Malware_Distribution)"; content:"|09|leanspeck|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letconsul.org (Malware_Distribution)"; content:"|09|letconsul|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup libelconvoy.org (Malware_Distribution)"; content:"|0b|libelconvoy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lieweld.org (Malware_Distribution)"; content:"|07|lieweld|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup likesfetter.org (Malware_Distribution)"; content:"|0b|likesfetter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linseedpaste.org (Malware_Distribution)"; content:"|0c|linseedpaste|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup little-miss.eu ()"; content:"|0b|little-miss|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup little-queens.net ()"; content:"|0d|little-queens|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lodgersow.org (Malware_Distribution)"; content:"|09|lodgersow|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lurofletzhen.com (SEO_Fraud)"; content:"|0c|lurofletzhen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morphiaseaside.org (Malware_Distribution)"; content:"|0e|morphiaseaside|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movingsnip.org (Malware_Distribution)"; content:"|0a|movingsnip|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mummeryscales.org (Malware_Distribution)"; content:"|0d|mummeryscales|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicframeit.com (SEO_Fraud)"; content:"|0c|musicframeit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musterydecoy.org (Malware_Distribution)"; content:"|0c|musterydecoy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muzzleastute.org (Malware_Distribution)"; content:"|0c|muzzleastute|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nationearn.org (Malware_Distribution)"; content:"|0a|nationearn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naughtgrubby.org (Malware_Distribution)"; content:"|0c|naughtgrubby|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbnjki.com (Malware_Distribution)"; content:"|06|nbnjki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nestjolt.org (Malware_Distribution)"; content:"|08|nestjolt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netllookup.com (Malware_Distribution)"; content:"|0a|netllookup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nightlyseeds.org (Malware_Distribution)"; content:"|0c|nightlyseeds|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nodeconvert.org (Malware_Distribution)"; content:"|0b|nodeconvert|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noisomechicane.org (Malware_Distribution)"; content:"|0e|noisomechicane|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nominalunwary.org (Malware_Distribution)"; content:"|0d|nominalunwary|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nullcandy.org (Malware_Distribution)"; content:"|09|nullcandy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup numbuse.org (Malware_Distribution)"; content:"|07|numbuse|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oatmealfrisk.org (Malware_Distribution)"; content:"|0c|oatmealfrisk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oatmealshatter.org (Malware_Distribution)"; content:"|0e|oatmealshatter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opticmoving.org (Malware_Distribution)"; content:"|0b|opticmoving|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orationyou.org (Malware_Distribution)"; content:"|0a|orationyou|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orderdid.org (Malware_Distribution)"; content:"|08|orderdid|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orhanhundred.org (Malware_Distribution)"; content:"|0c|orhanhundred|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otspark.org (Malware_Distribution)"; content:"|07|otspark|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overrunwooden.org (Malware_Distribution)"; content:"|0d|overrunwooden|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pacific-shippingline.com (Malware_Distribution)"; content:"|14|pacific-shippingline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pactcelery.org (Malware_Distribution)"; content:"|0a|pactcelery|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parkasse-at.net (Phishing_and_Theft)"; content:"|0b|parkasse-at|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pastrydug.org (Malware_Distribution)"; content:"|09|pastrydug|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pedalslacken.org (Malware_Distribution)"; content:"|0c|pedalslacken|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peindlsadesk.com (Zeus_Zbot_SpyEye)"; content:"|0c|peindlsadesk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pentfinite.org (Malware_Distribution)"; content:"|0a|pentfinite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pentmull.org (Malware_Distribution)"; content:"|08|pentmull|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsha.ru (Malware_Distribution)"; content:"|07|pillsha|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillshxal.ru (Malware_Distribution)"; content:"|09|pillshxal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillshxay.ru (Malware_Distribution)"; content:"|09|pillshxay|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillshxll.ru (Malware_Distribution)"; content:"|09|pillshxll|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillshxlo.ru (Malware_Distribution)"; content:"|09|pillshxlo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillshxng.ru (Malware_Distribution)"; content:"|09|pillshxng|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsvrer.ru (Malware_Distribution)"; content:"|09|pillsvrer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsvris.ru (Malware_Distribution)"; content:"|09|pillsvris|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsvriz.ru (Malware_Distribution)"; content:"|09|pillsvriz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsvrmm.ru (Malware_Distribution)"; content:"|09|pillsvrmm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pintineroass.com (Malware_Distribution)"; content:"|0c|pintineroass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup platinfutbolpark.com (Malware_Distribution)"; content:"|10|platinfutbolpark|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plentyvicious.org (Malware_Distribution)"; content:"|0d|plentyvicious|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plumtreacle.org (Malware_Distribution)"; content:"|0b|plumtreacle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pofxpills.ru (Malware_Distribution)"; content:"|09|pofxpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poisk-filefile.ru (Malware_Distribution)"; content:"|0e|poisk-filefile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poisk-filehouse.ru (Malware_Distribution)"; content:"|0f|poisk-filehouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poisk-find-get.ru (Malware_Distribution)"; content:"|0e|poisk-find-get|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poisk-find-stuff.ru (Malware_Distribution)"; content:"|10|poisk-find-stuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poisk-manyfile.ru (Malware_Distribution)"; content:"|0e|poisk-manyfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poisk-moment-find.ru (Malware_Distribution)"; content:"|11|poisk-moment-find|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poiskarchiv-file.ru (Malware_Distribution)"; content:"|10|poiskarchiv-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poiskarchiv-moment.ru (Malware_Distribution)"; content:"|12|poiskarchiv-moment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poiskdownloadfiles.ru (Malware_Distribution)"; content:"|12|poiskdownloadfiles|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poiskfile-all.ru (Malware_Distribution)"; content:"|0d|poiskfile-all|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poiskfilesearch.ru (Malware_Distribution)"; content:"|0f|poiskfilesearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poiskstuff-all.ru (Malware_Distribution)"; content:"|0e|poiskstuff-all|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pompousdenial.org (Malware_Distribution)"; content:"|0d|pompousdenial|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ponderbelong.org (Malware_Distribution)"; content:"|0c|ponderbelong|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popestrict.org (Malware_Distribution)"; content:"|0a|popestrict|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portculis.com (Malware_Distribution)"; content:"|09|portculis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portionchagrin.org (Malware_Distribution)"; content:"|0e|portionchagrin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup posyhatch.org (Malware_Distribution)"; content:"|09|posyhatch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup potseclude.org (Malware_Distribution)"; content:"|0a|potseclude|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup power-wfchecker.in (Malware_Distribution)"; content:"|0f|power-wfchecker|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pragma5.com (Malware_Distribution)"; content:"|07|pragma5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prancecontour.org (Malware_Distribution)"; content:"|0d|prancecontour|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup praysad.org (Malware_Distribution)"; content:"|07|praysad|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup precededynamic.org (Malware_Distribution)"; content:"|0e|precededynamic|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prexysm.be (Malware_Distribution)"; content:"|07|prexysm|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup primacyresin.org (Malware_Distribution)"; content:"|0c|primacyresin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prosaiccube.org (Malware_Distribution)"; content:"|0b|prosaiccube|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup provereject.org (Malware_Distribution)"; content:"|0b|provereject|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puristar.org (Malware_Distribution)"; content:"|08|puristar|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup purposestupid.org (Malware_Distribution)"; content:"|0d|purposestupid|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quartpliancy.org (Malware_Distribution)"; content:"|0c|quartpliancy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup questscantwo.com (Malware_Distribution)"; content:"|0c|questscantwo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup racialfreshe.org (Malware_Distribution)"; content:"|0c|racialfreshe|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rashcrowd.org (Malware_Distribution)"; content:"|09|rashcrowd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ratchet.fileave.com (Malware_Distribution)"; content:"|07|ratchet|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rbsonlinebank.com (Malware_Distribution)"; content:"|0d|rbsonlinebank|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readerocular.org (Malware_Distribution)"; content:"|0c|readerocular|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rebirthfalcon.org (Malware_Distribution)"; content:"|0d|rebirthfalcon|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rectoryfeign.org (Malware_Distribution)"; content:"|0c|rectoryfeign|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refereeshe.org (Malware_Distribution)"; content:"|0a|refereeshe|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reflexpan.org (Malware_Distribution)"; content:"|09|reflexpan|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refundwine.org (Malware_Distribution)"; content:"|0a|refundwine|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup religion-vernetzt.de (Malware_Distribution)"; content:"|11|religion-vernetzt|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remissdeceive.org (Malware_Distribution)"; content:"|0d|remissdeceive|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup repentavow.org (Malware_Distribution)"; content:"|0a|repentavow|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup repulsemaximum.org (Malware_Distribution)"; content:"|0e|repulsemaximum|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riddensoot.org (Malware_Distribution)"; content:"|0a|riddensoot|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rofxpills.ru (Malware_Distribution)"; content:"|09|rofxpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royal-shippe.com (Malware_Distribution)"; content:"|0c|royal-shippe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rsgenerator3.fileave.com (Malware_Distribution)"; content:"|0c|rsgenerator3|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rsgenerator4.fileave.com (Malware_Distribution)"; content:"|0c|rsgenerator4|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rsstooltip.com (Malware_Distribution)"; content:"|0a|rsstooltip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup runletlanky.org (Malware_Distribution)"; content:"|0b|runletlanky|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s0r.ru ()"; content:"|03|s0r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s3lab.org (Malware_Distribution)"; content:"|05|s3lab|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s3t4.nm.ru (Malware_Distribution)"; content:"|04|s3t4|02|nm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safxpills.ru (Malware_Distribution)"; content:"|09|safxpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saintlunatic.org (Malware_Distribution)"; content:"|0c|saintlunatic|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saninternet.com (Malware_Distribution)"; content:"|0b|saninternet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup santandercadastro.fileave.com (Malware_Distribution)"; content:"|11|santandercadastro|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sapammonia.org (Malware_Distribution)"; content:"|0a|sapammonia|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savourotter.org (Malware_Distribution)"; content:"|0b|savourotter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scamdrizzle.fileave.com (Malware_Distribution)"; content:"|0b|scamdrizzle|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scumwoollen.org (Malware_Distribution)"; content:"|0b|scumwoollen|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-file-get.ru (Malware_Distribution)"; content:"|0f|search-file-get|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-poisk-house.ru (Malware_Distribution)"; content:"|12|search-poisk-house|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchallget.ru (Malware_Distribution)"; content:"|0c|searchallget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searcharchivget.ru (Malware_Distribution)"; content:"|0f|searcharchivget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchfile-all.ru (Malware_Distribution)"; content:"|0e|searchfile-all|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchfile-file.ru (Malware_Distribution)"; content:"|0f|searchfile-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchlotsfile.ru (Malware_Distribution)"; content:"|0e|searchlotsfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchmomentfile.ru (Malware_Distribution)"; content:"|10|searchmomentfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchstuffpoisk.ru (Malware_Distribution)"; content:"|10|searchstuffpoisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seniormilage.org (Malware_Distribution)"; content:"|0c|seniormilage|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sharewaredepo.com (Malware_Distribution)"; content:"|0d|sharewaredepo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2600978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shpillshx.ru (Malware_Distribution)"; content:"|09|shpillshx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjiaalrsmcp.com (Malware_Distribution)"; content:"|0b|sjiaalrsmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skjbsldkjksfhu.com (Zeus_Zbot_SpyEye)"; content:"|0e|skjbsldkjksfhu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sparkasse-at.com (Phishing_and_Theft)"; content:"|0c|sparkasse-at|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportsviewer.in (Malware_Distribution)"; content:"|0c|sportsviewer|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topasarmy.in (Malware_Distribution)"; content:"|09|topasarmy|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vacancyagainst.org (Malware_Distribution)"; content:"|0e|vacancyagainst|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vanilaprojectlive.com (SEO_Fraud)"; content:"|11|vanilaprojectlive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veinassert.org (Malware_Distribution)"; content:"|0a|veinassert|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vileisolate.org (Malware_Distribution)"; content:"|0b|vileisolate|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visapeer.org (Malware_Distribution)"; content:"|08|visapeer|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup votegroggy.org (Malware_Distribution)"; content:"|0a|votegroggy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vovmml.com (Malware_Distribution)"; content:"|06|vovmml|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voyagebud.org (Malware_Distribution)"; content:"|09|voyagebud|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vultureoffer.org (Malware_Distribution)"; content:"|0c|vultureoffer|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waivertouch.org (Malware_Distribution)"; content:"|0b|waivertouch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waspad.org (Malware_Distribution)"; content:"|06|waspad|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wastefuzz.org (Malware_Distribution)"; content:"|09|wastefuzz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ywtgytkejnke.com (Zeus_Zbot_SpyEye)"; content:"|0c|ywtgytkejnke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rytectvo.host.sk (Malware_Distribution)"; content:"|08|rytectvo|04|host|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afrobrutality.com (Malware_Distribution)"; content:"|0d|afrobrutality|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afroskull-barbellclub.com (Malware_Distribution)"; content:"|15|afroskull-barbellclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allcle-safe.in (Phishing_and_Theft)"; content:"|0b|allcle-safe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alysamb.net (Malware_Distribution)"; content:"|07|alysamb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-jsentinel.in (Phishing_and_Theft)"; content:"|0e|best-jsentinel|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-networkqjo.in (Phishing_and_Theft)"; content:"|0f|best-networkqjo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bester-msecuriity.in (Phishing_and_Theft)"; content:"|11|bester-msecuriity|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxofficemojo.tk (Malware_Distribution)"; content:"|0d|boxofficemojo|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brawaidme.in (Phishing_and_Theft)"; content:"|09|brawaidme|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bredosaita.ru ()"; content:"|0a|bredosaita|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crossfitnewcastle.com.au (Malware_Distribution)"; content:"|11|crossfitnewcastle|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d0ct0rh0use.com (Malware_Distribution)"; content:"|0b|d0ct0rh0use|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dguniverse.tk (Malware_Distribution)"; content:"|0a|dguniverse|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doneahme.in (Phishing_and_Theft)"; content:"|08|doneahme|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebaliu.com (Zeus_Zbot_SpyEye)"; content:"|06|ebaliu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enablesecureum.in (Phishing_and_Theft)"; content:"|0e|enablesecureum|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enchant-ofsquer.com ()"; content:"|0f|enchant-ofsquer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstholdermvq.in (Phishing_and_Theft)"; content:"|0e|firstholdermvq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup games-and-soft.ru ()"; content:"|0e|games-and-soft|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gangbang-teens.com ()"; content:"|0e|gangbang-teens|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-plus-plus.tk (Malware_Distribution)"; content:"|10|google-plus-plus|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlessl.tk (Malware_Distribution)"; content:"|09|googlessl|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gravurediffusion.fr (Phishing_and_Theft)"; content:"|10|gravurediffusion|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-antivirbjb.in (Fake_AV)"; content:"|0f|hard-antivirbjb|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardbsy-network.in (Phishing_and_Theft)"; content:"|0f|hardbsy-network|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardynauchecker.in (Phishing_and_Theft)"; content:"|0f|hardynauchecker|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holysony.com ()"; content:"|08|holysony|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosting1-de.santrex.net ()"; content:"|0b|hosting1-de|07|santrex|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosting1.de.santrex.net ()"; content:"|08|hosting1|02|de|07|santrex|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugeble-cure.in (Phishing_and_Theft)"; content:"|0c|hugeble-cure|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ignservice.com (Malware_Distribution)"; content:"|0a|ignservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inclosegem.org (Malware_Distribution)"; content:"|0a|inclosegem|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup incurhealth.org (Malware_Distribution)"; content:"|0b|incurhealth|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inducttrunk.org (Malware_Distribution)"; content:"|0b|inducttrunk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innentry.org (Malware_Distribution)"; content:"|08|innentry|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innersoloist.org (Malware_Distribution)"; content:"|0c|innersoloist|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inroadperish.org (Malware_Distribution)"; content:"|0c|inroadperish|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insanmiyiz.biz ()"; content:"|0a|insanmiyiz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup installherb.org (Malware_Distribution)"; content:"|0b|installherb|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intentbell.org (Malware_Distribution)"; content:"|0a|intentbell|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ironingonset.org (Malware_Distribution)"; content:"|0c|ironingonset|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jagawars.tk (Malware_Distribution)"; content:"|08|jagawars|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaifr.com ()"; content:"|05|jaifr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jfrmt.net ()"; content:"|05|jfrmt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jifr.net ()"; content:"|04|jifr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jscconsulting.tk (Malware_Distribution)"; content:"|0d|jscconsulting|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main1.in ()"; content:"|05|main1|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main3.in ()"; content:"|05|main3|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main4.in ()"; content:"|05|main4|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main6.in ()"; content:"|05|main6|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main7.in ()"; content:"|05|main7|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main9.in ()"; content:"|05|main9|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microhousezez.com ()"; content:"|0d|microhousezez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moreaz-fine.in (Phishing_and_Theft)"; content:"|0b|moreaz-fine|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup most-popularsoftcontent.in (Phishing_and_Theft)"; content:"|17|most-popularsoftcontent|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieawardsrss.tk (Malware_Distribution)"; content:"|0e|movieawardsrss|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviedatabasesrv.com (Malware_Distribution)"; content:"|10|moviedatabasesrv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movietrackeronline.tk (Malware_Distribution)"; content:"|12|movietrackeronline|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup open-994233.com (Spyware)"; content:"|0b|open-994233|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ostestsystemri.in (Phishing_and_Theft)"; content:"|0e|ostestsystemri|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ourdatatransfers.com (Malware_Distribution)"; content:"|10|ourdatatransfers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paperrain.net ()"; content:"|09|paperrain|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paydayloansonlinesite.info ()"; content:"|15|paydayloansonlinesite|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-bpsentinel.in (Phishing_and_Theft)"; content:"|13|personal-bpsentinel|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-internet-foryou.in (Phishing_and_Theft)"; content:"|18|personal-internet-foryou|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalcleansoft.in (Phishing_and_Theft)"; content:"|11|personalcleansoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalscannerlg.in (Phishing_and_Theft)"; content:"|11|personalscannerlg|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phantombecame.org (Malware_Distribution)"; content:"|0d|phantombecame|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phantomsell.org (Malware_Distribution)"; content:"|0b|phantomsell|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoofpromise.com (Malware_Distribution)"; content:"|0e|photoofpromise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pigskinturn.org (Malware_Distribution)"; content:"|0b|pigskinturn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pilgrimstrut.org (Malware_Distribution)"; content:"|0c|pilgrimstrut|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsdxel.ru (Malware_Distribution)"; content:"|09|pillsdxel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsdxge.ru (Malware_Distribution)"; content:"|09|pillsdxge|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsdxhe.ru (Malware_Distribution)"; content:"|09|pillsdxhe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsdxiw.ru (Malware_Distribution)"; content:"|09|pillsdxiw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsdxkb.ru (Malware_Distribution)"; content:"|09|pillsdxkb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsdxla.ru (Malware_Distribution)"; content:"|09|pillsdxla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsdxni.ru (Malware_Distribution)"; content:"|09|pillsdxni|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsdxpa.ru (Malware_Distribution)"; content:"|09|pillsdxpa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerscanercis.in (Phishing_and_Theft)"; content:"|0e|powerscanercis|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quantcounter.com (Malware_Distribution)"; content:"|0c|quantcounter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rideusfor.in (Phishing_and_Theft)"; content:"|09|rideusfor|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup romoreok.tk (Malware_Distribution)"; content:"|08|romoreok|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-securityarmy.in (Phishing_and_Theft)"; content:"|11|safe-securityarmy|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-solutionsoft.in (Phishing_and_Theft)"; content:"|11|safe-solutionsoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safepowerforu.in (Phishing_and_Theft)"; content:"|0d|safepowerforu|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safexanet.in (Phishing_and_Theft)"; content:"|09|safexanet|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveinternet-guard.in (Phishing_and_Theft)"; content:"|12|saveinternet-guard|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbcsfnksmcp.com (Botnet_C&C)"; content:"|0b|sbcsfnksmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simplexstored.com (Malware_Distribution)"; content:"|0d|simplexstored|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-guardianro.in (Phishing_and_Theft)"; content:"|10|smart-guardianro|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-suiteguard.in (Phishing_and_Theft)"; content:"|10|smart-suiteguard|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartaasecurity.in (Phishing_and_Theft)"; content:"|0f|smartaasecurity|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartantivir-scanner.in (Fake_AV)"; content:"|14|smartantivir-scanner|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartklhdefense.in (Phishing_and_Theft)"; content:"|0f|smartklhdefense|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-checkerwrt.in (Phishing_and_Theft)"; content:"|11|strong-checkerwrt|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-guardbxz.in (Phishing_and_Theft)"; content:"|0f|strong-guardbxz|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telki-2010.ru (Malware_Distribution)"; content:"|0a|telki-2010|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestkrearmy.in (Phishing_and_Theft)"; content:"|0e|thebestkrearmy|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebeststatsanalytics.com (Malware_Distribution)"; content:"|15|thebeststatsanalytics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timobreuer.de (Malware_Distribution)"; content:"|0a|timobreuer|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topantivir-foru.in (Fake_AV)"; content:"|0f|topantivir-foru|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topksfsecurity.in (Phishing_and_Theft)"; content:"|0e|topksfsecurity|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topmovietracker.tk (Malware_Distribution)"; content:"|0f|topmovietracker|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topsecuritykauu.in (Phishing_and_Theft)"; content:"|0f|topsecuritykauu|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twiferryera.com (Malware_Distribution)"; content:"|0b|twiferryera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uberate-safe.in (Phishing_and_Theft)"; content:"|0c|uberate-safe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uberble-safe.in (Phishing_and_Theft)"; content:"|0c|uberble-safe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unieve-safe.in (Phishing_and_Theft)"; content:"|0b|unieve-safe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uniind-safe.in (Phishing_and_Theft)"; content:"|0b|uniind-safe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ups-post.net (Malware_Distribution)"; content:"|08|ups-post|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vapillshx.ru (Malware_Distribution)"; content:"|09|vapillshx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w67.org (Malware_Distribution)"; content:"|03|w67|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wbcsflkwmcp.com (Botnet_C&C)"; content:"|0b|wbcsflkwmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup with-love.me ()"; content:"|09|with-love|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xraysz.com ()"; content:"|06|xraysz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xzrw0q.com ()"; content:"|06|xzrw0q|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourhqimages.com (Malware_Distribution)"; content:"|0c|yourhqimages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursuperstatscounter-web.com (Malware_Distribution)"; content:"|19|yoursuperstatscounter-web|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zepills.ru (Malware_Distribution)"; content:"|07|zepills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zz.cdbeta.com (Malware_Distribution)"; content:"|02|zz|06|cdbeta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allmetalforums.com (Malware_Distribution)"; content:"|0e|allmetalforums|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjlpranks.com (Malware_Infectors)"; content:"|09|rjlpranks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gassystem.co.kr (Malware_Distribution)"; content:"|09|gassystem|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groupeflo-franchises.net (Malware_Distribution)"; content:"|14|groupeflo-franchises|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joins.com (Malware_Distribution)"; content:"|05|joins|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p6ox.co.cc (Malware_Infectors)"; content:"|04|p6ox|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sipyjo.cn (Malware_Distribution)"; content:"|06|sipyjo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taruntextiles.com (Malware_Distribution)"; content:"|0d|taruntextiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0575sos.cn (Malware_Distribution)"; content:"|07|0575sos|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0fc6d6d.com (Malware_Infectors)"; content:"|07|0fc6d6d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4dq.com (Malware_Distribution)"; content:"|03|4dq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 55fk.com (Malware_Distribution)"; content:"|04|55fk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abpillsvr.ru (Malware_Distribution)"; content:"|09|abpillsvr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accessltd.ru ()"; content:"|09|accessltd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adurr.com (Malware_Distribution)"; content:"|05|adurr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup algrsat.com (Malware_Distribution)"; content:"|07|algrsat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-house-search.ru (Malware_Distribution)"; content:"|10|all-house-search|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-houselots.ru (Malware_Distribution)"; content:"|0d|all-houselots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-manyfind.ru (Malware_Distribution)"; content:"|0c|all-manyfind|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-stuff-search.ru (Malware_Distribution)"; content:"|10|all-stuff-search|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allarchivpoisk.ru (Malware_Distribution)"; content:"|0e|allarchivpoisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allarchivsearch.ru (Malware_Distribution)"; content:"|0f|allarchivsearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allfind-file.ru (Malware_Distribution)"; content:"|0c|allfind-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allfind-files.ru (Malware_Distribution)"; content:"|0d|allfind-files|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allfresh.us ()"; content:"|08|allfresh|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allinonespy.com (Malware_Distribution)"; content:"|0b|allinonespy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alllots-file.ru (Malware_Distribution)"; content:"|0c|alllots-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allpoisk-stuff.ru (Malware_Distribution)"; content:"|0e|allpoisk-stuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allstuff-moment.ru (Malware_Distribution)"; content:"|0f|allstuff-moment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amfxpills.ru (Malware_Distribution)"; content:"|09|amfxpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amourcollection.ru (Malware_Distribution)"; content:"|0f|amourcollection|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup andrewloh.com (Malware_Distribution)"; content:"|09|andrewloh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anfxpills.ru (Malware_Distribution)"; content:"|09|anfxpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ansaab.com (Malware_Distribution)"; content:"|06|ansaab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virus.sytes.net (Fake_AV)"; content:"|0a|anti-virus|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-groups.com (Fake_AV)"; content:"|10|antivirus-groups|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup approven.su ()"; content:"|08|approven|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archiv-all-moment.ru (Malware_Distribution)"; content:"|11|archiv-all-moment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archiv-find-house.ru (Malware_Distribution)"; content:"|11|archiv-find-house|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archiv-manyget.ru (Malware_Distribution)"; content:"|0e|archiv-manyget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archiv-search-download.ru (Malware_Distribution)"; content:"|16|archiv-search-download|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archiv-stufffiles.ru (Malware_Distribution)"; content:"|11|archiv-stufffiles|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archivallhouse.ru (Malware_Distribution)"; content:"|0e|archivallhouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archivdownloadsearch.ru (Malware_Distribution)"; content:"|14|archivdownloadsearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archivmoment-poisk.ru (Malware_Distribution)"; content:"|12|archivmoment-poisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archivmomentdownload.ru (Malware_Distribution)"; content:"|14|archivmomentdownload|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archivsearch-stuff.ru (Malware_Distribution)"; content:"|12|archivsearch-stuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archivsearchlots.ru (Malware_Distribution)"; content:"|10|archivsearchlots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archivstuffdownload.ru (Malware_Distribution)"; content:"|13|archivstuffdownload|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archivstufffile.ru (Malware_Distribution)"; content:"|0f|archivstufffile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atpillsvr.ru (Malware_Distribution)"; content:"|09|atpillsvr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup automarkt-augst.ch (Malware_Distribution)"; content:"|0f|automarkt-augst|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av3308.3322.org (Malware_Distribution)"; content:"|06|av3308|04|3322|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awake-candy.xe.cx (Malware_Distribution)"; content:"|0b|awake-candy|02|xe|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axeswizardepx.ru (Malware_Distribution)"; content:"|0d|axeswizardepx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baner3.in (Malware_Distribution)"; content:"|06|baner3|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beatok.in (Spyware)"; content:"|06|beatok|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestdumps.biz ()"; content:"|09|bestdumps|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestdumps.su ()"; content:"|09|bestdumps|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biosman.com (Malware_Distribution)"; content:"|07|biosman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackblackblack.gicp.net (Malware_Distribution)"; content:"|0f|blackblackblack|04|gicp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackofspogus.com (Malware_Distribution)"; content:"|0d|blackofspogus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booksforbool.com (Malware_Distribution)"; content:"|0c|booksforbool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bryant-benway.com (Malware_Distribution)"; content:"|0d|bryant-benway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bshades.ru (Malware_Distribution)"; content:"|07|bshades|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buffygalaxy.com (Malware_Distribution)"; content:"|0b|buffygalaxy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulba.cc ()"; content:"|05|bulba|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caboria.net (Malware_Distribution)"; content:"|07|caboria|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cafxpills.ru (Malware_Distribution)"; content:"|09|cafxpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cardshop.bz ()"; content:"|08|cardshop|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccc.de (Malware_Distribution)"; content:"|03|ccc|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccmall.cc ()"; content:"|06|ccmall|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccStore.ru ()"; content:"|07|ccStore|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheat-downloader-s1.ru (Malware_Distribution)"; content:"|13|cheat-downloader-s1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillout.rs (Malware_Distribution)"; content:"|08|chillout|02|rs"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chiptuners.co.uk (Malware_Distribution)"; content:"|0a|chiptuners|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickpc.ro (Malware_Distribution)"; content:"|07|clickpc|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cookingcutlery.com (Malware_Distribution)"; content:"|0e|cookingcutlery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coopic.cn (Malware_Distribution)"; content:"|06|coopic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cv2shop.com ()"; content:"|07|cv2shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxlpills.ru (Malware_Distribution)"; content:"|08|cxlpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dartzofmybpull.ru (Malware_Distribution)"; content:"|0e|dartzofmybpull|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup data.fuskbugg.se (Malware_Distribution)"; content:"|04|data|08|fuskbugg|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup denron.com.sg ()"; content:"|06|denron|03|com|02|sg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deposiftiles.ru (Malware_Distribution)"; content:"|0c|deposiftiles|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgd.ns01.us (Malware_Distribution)"; content:"|03|dgd|04|ns01|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dje.isgre.at (Malware_Distribution)"; content:"|03|dje|05|isgre|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dl.2mx1.com (Malware_Distribution)"; content:"|02|dl|04|2mx1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dopillsvr.ru (Malware_Distribution)"; content:"|09|dopillsvr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dosmedic.ru (Malware_Distribution)"; content:"|08|dosmedic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duffiduffid.ru (Malware_Distribution)"; content:"|0b|duffiduffid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duklio.com (Malware_Distribution)"; content:"|06|duklio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dumpshop.bz ()"; content:"|08|dumpshop|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dzmeritelshop.ru (Malware_Distribution)"; content:"|0d|dzmeritelshop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eaglenest-gela.com (Malware_Distribution)"; content:"|0e|eaglenest-gela|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eclipsebooting.co.cc (Zeus_Zbot_SpyEye)"; content:"|0e|eclipsebooting|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eluter.be (Malware_Distribution)"; content:"|06|eluter|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fabsnot.ru (Malware_Distribution)"; content:"|07|fabsnot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faceliboooks.com (Malware_Distribution)"; content:"|0c|faceliboooks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facerlboooks.net (Malware_Distribution)"; content:"|0c|facerlboooks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgrag3.com (Malware_Distribution)"; content:"|06|fgrag3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup financialpoet.com (Malware_Distribution)"; content:"|0d|financialpoet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstcwnetwork.rr.nu (Malware_Distribution)"; content:"|0e|firstcwnetwork|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstnfsecurity.rr.nu (Malware_Distribution)"; content:"|0f|firstnfsecurity|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flyshopear.ru (Malware_Infectors)"; content:"|0a|flyshopear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotoinmuebles.com (Malware_Distribution)"; content:"|0d|fotoinmuebles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fr7kk8.in (Malware_Distribution)"; content:"|06|fr7kk8|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshstock.biz ()"; content:"|0a|freshstock|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gbjobb.com (Fake_AV)"; content:"|06|gbjobb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getc0-f1lds.servehalflife.com (Malware_Distribution)"; content:"|0b|getc0-f1lds|0d|servehalflife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getinmo.net (Malware_Distribution)"; content:"|07|getinmo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-banking.com (Malware_Distribution)"; content:"|0e|google-banking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greecejobb.com (Fake_AV)"; content:"|0a|greecejobb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsccentralohio.com (Malware_Distribution)"; content:"|0e|gsccentralohio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoperjulia.com (Malware_Distribution)"; content:"|0a|hoperjulia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iejaor.com (Malware_Distribution)"; content:"|06|iejaor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkub.com (Malware_Distribution)"; content:"|04|jkub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobbsearcher.com (Fake_AV)"; content:"|0c|jobbsearcher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobbslists.com (Fake_AV)"; content:"|0a|jobbslists|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup katalogowaniereczne.pl (Malware_Distribution)"; content:"|13|katalogowaniereczne|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klmservice.ru (Malware_Infectors)"; content:"|0a|klmservice|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koklip.com (Malware_Distribution)"; content:"|06|koklip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup literaturajestsexy.pl (Malware_Distribution)"; content:"|12|literaturajestsexy|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lu4isa.com (Malware_Distribution)"; content:"|06|lu4isa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magic-numbers.cc ()"; content:"|0d|magic-numbers|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marinapaezuribe.com (Malware_Distribution)"; content:"|0f|marinapaezuribe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matoway.com (Zeus_Zbot_SpyEye)"; content:"|07|matoway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega4u.biz ()"; content:"|06|mega4u|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycc.su ()"; content:"|04|mycc|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n3ot6op.com (Malware_Distribution)"; content:"|07|n3ot6op|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naughtywifepal.ru (Malware_Distribution)"; content:"|0e|naughtywifepal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nodpad.com (Malware_Distribution)"; content:"|06|nodpad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ollybroad.co.uk (Botnet_C&C)"; content:"|09|ollybroad|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olsoncares.com (Malware_Distribution)"; content:"|0a|olsoncares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onepet.ru (Malware_Distribution)"; content:"|06|onepet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfect-numbers.cc ()"; content:"|0f|perfect-numbers|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plasticinetec.ru (Malware_Distribution)"; content:"|0d|plasticinetec|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnncrrusted.info (Malware_Infectors)"; content:"|0b|pnncrrusted|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poczta.orgmasz.pl (Malware_Distribution)"; content:"|06|poczta|07|orgmasz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popspostenkple.ru (Malware_Distribution)"; content:"|0e|popspostenkple|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privateservices.ws ()"; content:"|0f|privateservices|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proepbig.rr.nu (Malware_Distribution)"; content:"|08|proepbig|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pwnshop.cc ()"; content:"|07|pwnshop|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pyrus.user.icpnet.pl (Malware_Distribution)"; content:"|05|pyrus|04|user|06|icpnet|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recruitaimsfg.com (Malware_Distribution)"; content:"|0d|recruitaimsfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup returenget60.net (Zeus_Zbot_SpyEye)"; content:"|0c|returenget60|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rm6.org (Malware_Infectors)"; content:"|03|rm6|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundsites.com (Malware_Distribution)"; content:"|0a|roundsites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rudeink.ru (Malware_Distribution)"; content:"|07|rudeink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup runnystorm.ru (Malware_Distribution)"; content:"|0a|runnystorm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secondconcert.ru (Malware_Distribution)"; content:"|0d|secondconcert|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shah.website.org (Malware_Distribution)"; content:"|04|shah|07|website|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sichererautoverkauf.net (Malware_Distribution)"; content:"|13|sichererautoverkauf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softmarkets.ru (Malware_Distribution)"; content:"|0b|softmarkets|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sornyaki23.ru (Malware_Distribution)"; content:"|0a|sornyaki23|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssddrr2.info (Malware_Infectors)"; content:"|07|ssddrr2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats1.in (Malware_Distribution)"; content:"|06|stats1|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup steelcinetecs.ru (Malware_Distribution)"; content:"|0d|steelcinetecs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t3a4ano.com (Malware_Distribution)"; content:"|07|t3a4ano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabanflourmills.ir (Malware_Distribution)"; content:"|0f|tabanflourmills|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamilworldinfo.net (Malware_Distribution)"; content:"|0e|tamilworldinfo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tinpiano.com (Malware_Distribution)"; content:"|08|tinpiano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup track2.name ()"; content:"|06|track2|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackstore.su ()"; content:"|0a|trackstore|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradesystemsy.com (Malware_Distribution)"; content:"|0d|tradesystemsy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsqayzz.com (Malware_Distribution)"; content:"|07|tsqayzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unionaccount.in (Malware_Infectors)"; content:"|0c|unionaccount|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vzone.tc ()"; content:"|05|vzone|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup widuop.com (Malware_Distribution)"; content:"|06|widuop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsxhost.net (Malware_Distribution)"; content:"|07|wsxhost|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmjhx.com (Malware_Distribution)"; content:"|05|xmjhx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ydibojahigiqy.mysecondarydns.com (Malware_Distribution)"; content:"|0d|ydibojahigiqy|0e|mysecondarydns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup you-want-me.ru (Malware_Distribution)"; content:"|0b|you-want-me|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youthofthenationalists.com (Malware_Distribution)"; content:"|16|youthofthenationalists|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeino.net (Malware_Distribution)"; content:"|05|zeino|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2eesats2222.cx.cc (Malware_Distribution)"; content:"|0b|2eesats2222|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activation-card.ru (Malware_Infectors)"; content:"|0f|activation-card|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup art-ffr.ru (Malware_Infectors)"; content:"|07|art-ffr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badbase.ru (Fake_AV)"; content:"|07|badbase|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestjovelcoasteeras.com (Malware_Infectors)"; content:"|13|bestjovelcoasteeras|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestphatchicks.com (Malware_Infectors)"; content:"|0e|bestphatchicks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bhjaezqbncz.com (Malware_Infectors)"; content:"|0b|bhjaezqbncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billingcenter.co.cc (Zeus_Zbot_SpyEye)"; content:"|0d|billingcenter|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blablablamrfreemanok.cx.cc (Malware_Distribution)"; content:"|14|blablablamrfreemanok|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byltrmh.ru (Malware_Infectors)"; content:"|07|byltrmh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfgrucicmcp.com (Malware_Infectors)"; content:"|0b|cfgrucicmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cjikacccmcp.com (Malware_Infectors)"; content:"|0b|cjikacccmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crossallbordersondog.com (Malware_Infectors)"; content:"|14|crossallbordersondog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easy2089.co.cc (Malware_Infectors)"; content:"|08|easy2089|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ehjypoqemcp.com (Malware_Infectors)"; content:"|0b|ehjypoqemcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairwaykansasrealestate.com (Malware_Infectors)"; content:"|17|fairwaykansasrealestate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findhouseget.ru (Malware_Distribution)"; content:"|0c|findhouseget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findlotsfile.ru (Malware_Distribution)"; content:"|0c|findlotsfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findpoiskfile.ru (Malware_Distribution)"; content:"|0d|findpoiskfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findsearchfile.ru (Malware_Distribution)"; content:"|0e|findsearchfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flayin.be (Malware_Distribution)"; content:"|06|flayin|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fonfo.info (Malware_Distribution)"; content:"|05|fonfo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forgottoshowmyid.com (Malware_Infectors)"; content:"|10|forgottoshowmyid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forumpkonline.com (Malware_Distribution)"; content:"|0d|forumpkonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frtualpornclub.com (Malware_Infectors)"; content:"|0e|frtualpornclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frxpills.ru (Malware_Distribution)"; content:"|08|frxpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fsd.coom.in (Malware_Distribution)"; content:"|03|fsd|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftwtogether.ru (Zeus_Zbot_SpyEye)"; content:"|0b|ftwtogether|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fzabalkanized.info (Malware_Infectors)"; content:"|0d|fzabalkanized|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaugusch.at (Malware_Distribution)"; content:"|08|gaugusch|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gazduim.com (Malware_Distribution)"; content:"|07|gazduim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdefaowgmcp.com (Malware_Distribution)"; content:"|0b|gdefaowgmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geesanoff.cz.cc (Malware_Infectors)"; content:"|09|geesanoff|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gefbkwsgmcp.com (Malware_Infectors)"; content:"|0b|gefbkwsgmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-downloadfind.ru (Malware_Distribution)"; content:"|10|get-downloadfind|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-file-download.ru (Malware_Distribution)"; content:"|11|get-file-download|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-files-poisk.ru (Malware_Distribution)"; content:"|0f|get-files-poisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-search-file.ru (Malware_Distribution)"; content:"|0f|get-search-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-searchhouse.ru (Malware_Distribution)"; content:"|0f|get-searchhouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getalllots.ru (Malware_Distribution)"; content:"|0a|getalllots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getarchivfile.ru (Malware_Distribution)"; content:"|0d|getarchivfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getfileslots.ru (Malware_Distribution)"; content:"|0c|getfileslots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ggggrrrr.coom.in (Malware_Distribution)"; content:"|08|ggggrrrr|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giabkjsgmcp.com (Malware_Infectors)"; content:"|0b|giabkjsgmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup global-shipper.co.uk (Malware_Distribution)"; content:"|0e|global-shipper|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goesldrawtlock.com (Malware_Infectors)"; content:"|0e|goesldrawtlock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groun.be (Malware_Distribution)"; content:"|05|groun|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guamedic.ru (Malware_Distribution)"; content:"|08|guamedic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gukohyouce.edns.biz (Malware_Distribution)"; content:"|0a|gukohyouce|04|edns|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hennog.cz.cc (Malware_Infectors)"; content:"|06|hennog|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhtres.com (Malware_Distribution)"; content:"|06|hhtres|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hixpills.ru (Malware_Distribution)"; content:"|08|hixpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotelstremblant.com ()"; content:"|0f|hotelstremblant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotspurequal.org (Malware_Distribution)"; content:"|0c|hotspurequal|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hourmesh.org (Malware_Distribution)"; content:"|08|hourmesh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup house-all-search.ru (Malware_Distribution)"; content:"|10|house-all-search|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jipills.ru (Malware_Distribution)"; content:"|07|jipills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joecaseeas.com (Malware_Infectors)"; content:"|0a|joecaseeas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joemorales.dumb1.com (Malware_Infectors)"; content:"|0a|joemorales|05|dumb1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jrk2hzd.ru (Malware_Infectors)"; content:"|07|jrk2hzd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jrpjordan15.fileave.com (Malware_Distribution)"; content:"|0b|jrpjordan15|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcayqtheorizer.info (Malware_Infectors)"; content:"|0e|kcayqtheorizer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kepillsfx.ru (Malware_Distribution)"; content:"|09|kepillsfx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kqarjarsiil.richardaturner.com (Malware_Infectors)"; content:"|0b|kqarjarsiil|0e|richardaturner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kugel3.com.ar (Malware_Distribution)"; content:"|06|kugel3|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup larukuton.com (Malware_Distribution)"; content:"|09|larukuton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laservietxinh.com (Malware_Distribution)"; content:"|0d|laservietxinh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lauramoorefashion.co.uk (Malware_Distribution)"; content:"|11|lauramoorefashion|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legrandirect.com (Malware_Distribution)"; content:"|0c|legrandirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lemoteam.net (Malware_Distribution)"; content:"|08|lemoteam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lhjptpglncz.com (Malware_Infectors)"; content:"|0b|lhjptpglncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linokat.ru (Malware_Distribution)"; content:"|07|linokat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livestats.in (Malware_Infectors)"; content:"|09|livestats|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lots-all-house.ru (Malware_Distribution)"; content:"|0e|lots-all-house|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lots-archiv-all.ru (Malware_Distribution)"; content:"|0f|lots-archiv-all|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lowestykorers.com (Malware_Infectors)"; content:"|0d|lowestykorers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariocart.cu.cc (Malware_Infectors)"; content:"|09|mariocart|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicrypj.ru (Malware_Distribution)"; content:"|09|medicrypj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicsavi.ru (Malware_Distribution)"; content:"|09|medicsavi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicsfor.ru (Malware_Distribution)"; content:"|09|medicsfor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medictini.ru (Malware_Distribution)"; content:"|09|medictini|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mefvkdnmmcp.com (Malware_Infectors)"; content:"|0b|mefvkdnmmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup molbideneoil.com (Malware_Distribution)"; content:"|0c|molbideneoil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momentsearchget.ru (Malware_Distribution)"; content:"|0f|momentsearchget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moppy.cz.cc (Malware_Infectors)"; content:"|05|moppy|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myactivedirectory.com (Malware_Distribution)"; content:"|11|myactivedirectory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfacebooksbd.net (Malware_Distribution)"; content:"|0d|myfacebooksbd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noescobshaw.knoxvilleplumberrecommendation.com (Malware_Infectors)"; content:"|0b|noescobshaw|1e|knoxvilleplumberrecommendation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ofgcuxtomcp.com (Malware_Infectors)"; content:"|0b|ofgcuxtomcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olch.cz.cc (Malware_Infectors)"; content:"|04|olch|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pakbr.info (Malware_Infectors)"; content:"|05|pakbr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paybucksinternet.ru (Malware_Infectors)"; content:"|10|paybucksinternet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalqd-holder.rr.nu (Malware_Distribution)"; content:"|11|personalqd-holder|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pozitronic.ce.ms (Malware_Distribution)"; content:"|0a|pozitronic|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup priscylanunesgp.com.br (Malware_Infectors)"; content:"|0f|priscylanunesgp|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pussy-grandma-limousine.com (Malware_Infectors)"; content:"|17|pussy-grandma-limousine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qghsfjkqmcp.com (Malware_Infectors)"; content:"|0b|qghsfjkqmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqrwkbalkanized.info (Malware_Infectors)"; content:"|0f|qqrwkbalkanized|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remarkablesearchsystem.com ()"; content:"|16|remarkablesearchsystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rushtohospitalnow.com (Malware_Infectors)"; content:"|11|rushtohospitalnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-scanervq.rr.nu (Malware_Distribution)"; content:"|0d|safe-scanervq|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safenesscontent.ru (Malware_Infectors)"; content:"|0f|safenesscontent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savefhsuite.rr.nu (Malware_Distribution)"; content:"|0b|savefhsuite|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scdeprvsmcp.com (Malware_Infectors)"; content:"|0b|scdeprvsmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shokoladdeath.ru (Zeus_Zbot_SpyEye)"; content:"|0d|shokoladdeath|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siabkgssmcp.com (Malware_Infectors)"; content:"|0b|siabkgssmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superscarytechnologies.com (Malware_Infectors)"; content:"|16|superscarytechnologies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theorizervnrrzw.info (Malware_Infectors)"; content:"|0f|theorizervnrrzw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup threesimpleguys.com (Malware_Infectors)"; content:"|0f|threesimpleguys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toysdog.ru (Malware_Infectors)"; content:"|07|toysdog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhjypvqumcp.com (Malware_Infectors)"; content:"|0b|uhjypvqumcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vjl3dvj.ru (Malware_Infectors)"; content:"|07|vjl3dvj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whitekingtiger.cx.cc (Malware_Distribution)"; content:"|0e|whitekingtiger|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youreplytomymessages.com (Malware_Infectors)"; content:"|14|youreplytomymessages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourprijectsinaustria.com (Malware_Infectors)"; content:"|15|yourprijectsinaustria|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zbtlpogtomcdlb.xbrkdl.com (Malware_Infectors)"; content:"|0e|zbtlpogtomcdlb|06|xbrkdl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1sense.info (Malware_Distribution)"; content:"|06|1sense|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7e43b4729d.co.cc (Zeus_Zbot_SpyEye)"; content:"|0a|7e43b4729d|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup account-union.in (Malware_Distribution)"; content:"|0d|account-union|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adventuremoni.com (Zeus_Zbot_SpyEye)"; content:"|0d|adventuremoni|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agency-riston.in (Malware_Distribution)"; content:"|0d|agency-riston|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agencycharge.in (Malware_Infectors)"; content:"|0c|agencycharge|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agencyriston.in (Malware_Distribution)"; content:"|0c|agencyriston|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajiqfqhancz.com (Malware_Infectors)"; content:"|0b|ajiqfqhancz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artisot.com (Zeus_Zbot_SpyEye)"; content:"|07|artisot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assistantbilling.in (Malware_Distribution)"; content:"|10|assistantbilling|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bentdate.ru (Malware_Infectors)"; content:"|08|bentdate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casateixeira.sites.uol.com.br (Malware_Infectors)"; content:"|0c|casateixeira|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catcumroutere.com (Zeus_Zbot_SpyEye)"; content:"|0d|catcumroutere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cezvid6.ru ()"; content:"|07|cezvid6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfbingdian.com (Phishing_and_Theft)"; content:"|0a|cfbingdian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup charge-riston.in (Malware_Distribution)"; content:"|0d|charge-riston|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chargeagency.in (Malware_Distribution)"; content:"|0c|chargeagency|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup check001.in (Malware_Distribution)"; content:"|08|check001|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup choirshpcd.info (Malware_Infectors)"; content:"|0a|choirshpcd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup claudiomaia1969.sites.uol.com.br (Malware_Infectors)"; content:"|0f|claudiomaia1969|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup code732546teh34.com (Spyware)"; content:"|0f|code732546teh34|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dark-stone.ru (Zeus_Zbot_SpyEye)"; content:"|0a|dark-stone|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dengipengi.com (Malware_Distribution)"; content:"|0a|dengipengi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dentalsg.sites.uol.com.br (Malware_Infectors)"; content:"|08|dentalsg|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deposit-consulting.ru (Spyware)"; content:"|12|deposit-consulting|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgor.dp.ua (Malware_Distribution)"; content:"|04|dgor|02|dp|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalarmory.net (Spyware)"; content:"|0d|digitalarmory|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drcutrapalis.orge.pl (Malware_Infectors)"; content:"|0c|drcutrapalis|04|orge|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duglascagemike.com (Zeus_Zbot_SpyEye)"; content:"|0e|duglascagemike|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup editions-hydromel.com (Malware_Infectors)"; content:"|11|editions-hydromel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faterininc.ru (Botnet_C&C)"; content:"|0a|faterininc|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galait.dp.ua (Malware_Distribution)"; content:"|06|galait|02|dp|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gbbr.de (Malware_Infectors)"; content:"|04|gbbr|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gograssman.com (Zeus_Zbot_SpyEye)"; content:"|0a|gograssman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlerapida.in (Malware_Distribution)"; content:"|0c|googlerapida|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgdajhd.nl.ai (Malware_Infectors)"; content:"|07|hgdajhd|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgjvid8.ru (Phishing_and_Theft)"; content:"|07|hgjvid8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhdjjjjrt.ce.ms (Spyware)"; content:"|09|hhdjjjjrt|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hidravale.sites.uol.com.br (Malware_Infectors)"; content:"|09|hidravale|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup higgame.com (Phishing_and_Theft)"; content:"|07|higgame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htcrepairparts.com (Malware_Infectors)"; content:"|0e|htcrepairparts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hxbfplcuk.co.uk (Malware_Distribution)"; content:"|09|hxbfplcuk|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hymnrough.org (Malware_Distribution)"; content:"|09|hymnrough|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idearevel.org (Malware_Distribution)"; content:"|09|idearevel|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifraud.eu ()"; content:"|06|ifraud|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igelooreityq.mydad.info (Malware_Distribution)"; content:"|0c|igelooreityq|05|mydad|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiacbbsincz.com (Botnet_C&C)"; content:"|0b|iiacbbsincz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilfacebookj.com (Malware_Distribution)"; content:"|0b|ilfacebookj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img8001.fileave.com (Malware_Distribution)"; content:"|07|img8001|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inware.in (Malware_Distribution)"; content:"|06|inware|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inxpills.ru (Malware_Distribution)"; content:"|08|inxpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipsi1.uwayapply.com (Malware_Distribution)"; content:"|05|ipsi1|09|uwayapply|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacarandacleaning.co.za (Malware_Distribution)"; content:"|11|jacarandacleaning|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup janbonnema.nl (Malware_Distribution)"; content:"|0a|janbonnema|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javaxupdate.fileave.com (Malware_Distribution)"; content:"|0b|javaxupdate|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jds923fdsfjsd.info (Zeus_Zbot_SpyEye)"; content:"|0d|jds923fdsfjsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobsearchoo.com (Fake_AV)"; content:"|0b|jobsearchoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiahgfxkncz.com (Malware_Infectors)"; content:"|0b|kiahgfxkncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kplporn5.ru (Malware_Infectors)"; content:"|08|kplporn5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llkjhjk555.ce.ms (Malware_Distribution)"; content:"|0a|llkjhjk555|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lots-downloadstuff.ru (Malware_Distribution)"; content:"|12|lots-downloadstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lots-filestuff.ru (Malware_Distribution)"; content:"|0e|lots-filestuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lots-momentsearch.ru (Malware_Distribution)"; content:"|11|lots-momentsearch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lots-poisk-moment.ru (Malware_Distribution)"; content:"|11|lots-poisk-moment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manydownload-files.ru (Malware_Distribution)"; content:"|12|manydownload-files|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manyfilefiles.ru (Malware_Distribution)"; content:"|0d|manyfilefiles|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manyfilemoment.ru (Malware_Distribution)"; content:"|0e|manyfilemoment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manyfilepoisk.ru (Malware_Distribution)"; content:"|0d|manyfilepoisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manygetlots.ru (Malware_Distribution)"; content:"|0b|manygetlots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manystuff-house.ru (Malware_Distribution)"; content:"|0f|manystuff-house|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2656999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mapills.ru (Malware_Distribution)"; content:"|07|mapills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mini-opera-6.in (Malware_Distribution)"; content:"|0c|mini-opera-6|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mxus.xcia.net (Malware_Distribution)"; content:"|04|mxus|04|xcia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerepiccoli.sites.uol.com.br (Malware_Infectors)"; content:"|0b|nerepiccoli|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newstatejob.com (Fake_AV)"; content:"|0b|newstatejob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nilton.silveira.sites.uol.com.br (Malware_Infectors)"; content:"|06|nilton|08|silveira|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup om-interactive.ru (Malware_Distribution)"; content:"|0e|om-interactive|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup organizationlenses.ru (Spyware)"; content:"|12|organizationlenses|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orvhojbvr.ce.ms (Malware_Infectors)"; content:"|09|orvhojbvr|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osloadserver.com (Malware_Distribution)"; content:"|0c|osloadserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outacemwe.pochta.ru (Malware_Distribution)"; content:"|09|outacemwe|06|pochta|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup payaccount.in (Malware_Distribution)"; content:"|0a|payaccount|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup payunion.in (Malware_Distribution)"; content:"|08|payunion|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poletas5.bget.ru (Zeus_Zbot_SpyEye)"; content:"|08|poletas5|04|bget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porkaxmx-freex3f.ru (Phishing_and_Theft)"; content:"|10|porkaxmx-freex3f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornoxcx-onlina3b.ru (Phishing_and_Theft)"; content:"|11|pornoxcx-onlina3b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redirstregentedhosplings.co.cc (Zeus_Zbot_SpyEye)"; content:"|18|redirstregentedhosplings|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riston-agency.in (Malware_Distribution)"; content:"|0d|riston-agency|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riston-charge.in (Malware_Distribution)"; content:"|0d|riston-charge|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ristonagency.in (Malware_Distribution)"; content:"|0c|ristonagency|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ristoncharge.in (Malware_Distribution)"; content:"|0c|ristoncharge|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruivrkq.in (Malware_Distribution)"; content:"|07|ruivrkq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruivrkqr.in (Malware_Distribution)"; content:"|08|ruivrkqr|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salsanr1.de (Spyware)"; content:"|08|salsanr1|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdgabe.co.cc (Malware_Infectors)"; content:"|06|sdgabe|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdseobe.co.cc (Malware_Infectors)"; content:"|07|sdseobe|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexyjob.in (Malware_Distribution)"; content:"|07|sexyjob|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shikalmuna.com (Zeus_Zbot_SpyEye)"; content:"|0a|shikalmuna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopdirect4u.com (Zeus_Zbot_SpyEye)"; content:"|0c|shopdirect4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skypedownload1.ru (Malware_Infectors)"; content:"|0e|skypedownload1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemscanner.ru (Malware_Infectors)"; content:"|0d|systemscanner|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todownloadfiles.com (Malware_Distribution)"; content:"|0f|todownloadfiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turbozalupa.ce.ms (Zeus_Zbot_SpyEye)"; content:"|0b|turbozalupa|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twitterhackerpro.com (Malware_Distribution)"; content:"|10|twitterhackerpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup union-account.in (Malware_Distribution)"; content:"|0d|union-account|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urnewlook.net (Malware_Infectors)"; content:"|09|urnewlook|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usanewjobgov.com (Fake_AV)"; content:"|0c|usanewjobgov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uturrrttttjjjpp.ce.ms (Spyware)"; content:"|0f|uturrrttttjjjpp|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vc-business.com (Malware_Infectors)"; content:"|0b|vc-business|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vermondprime.ru (Malware_Distribution)"; content:"|0c|vermondprime|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxnx-freex4a.ru (Phishing_and_Theft)"; content:"|10|videoxnx-freex4a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wadensity.com (Malware_Infectors)"; content:"|09|wadensity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiki-722866.com (Malware_Distribution)"; content:"|0b|wiki-722866|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldisfriendly.com (Spyware)"; content:"|0f|worldisfriendly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xydnf.com (Phishing_and_Theft)"; content:"|05|xydnf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourowndefence.net (Spyware)"; content:"|0e|yourowndefence|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursecuritysystem.org (Spyware)"; content:"|12|yoursecuritysystem|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zakachayfile.in (Malware_Distribution)"; content:"|0c|zakachayfile|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2squared.com (Malware_Infectors)"; content:"|08|2squared|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup absolut-app.ru ()"; content:"|0b|absolut-app|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup absolutapp.ru ()"; content:"|0a|absolutapp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actris.ru ()"; content:"|06|actris|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advertisingteaser.ru (Malware_Distribution)"; content:"|11|advertisingteaser|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware.com (Fake_AV)"; content:"|0b|antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assistant-first.ru ()"; content:"|0f|assistant-first|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aswaz.ddns.name (Malware_Distribution)"; content:"|05|aswaz|04|ddns|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bannerbit1.com (Malware_Distribution)"; content:"|0a|bannerbit1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bannerbit2.com (Malware_Distribution)"; content:"|0a|bannerbit2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bannerbit3.com (Malware_Distribution)"; content:"|0a|bannerbit3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biggavno.in (Malware_Distribution)"; content:"|08|biggavno|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capsule-terrabyte.ru ()"; content:"|11|capsule-terrabyte|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup card-activation.ru ()"; content:"|0f|card-activation|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cartoonz.bd.to (Malware_Distribution)"; content:"|08|cartoonz|02|bd|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup certificatecontroller.ru (Malware_Distribution)"; content:"|15|certificatecontroller|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chief-bagel.xe.cx (Malware_Distribution)"; content:"|0b|chief-bagel|02|xe|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup companyairline.ru ()"; content:"|0e|companyairline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connected-hed.com (Malware_Distribution)"; content:"|0d|connected-hed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup control-parts.ru ()"; content:"|0d|control-parts|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup controllercertificate.ru ()"; content:"|15|controllercertificate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwrewr.c0m.li (Malware_Distribution)"; content:"|06|dwrewr|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynamiccertificate.ru ()"; content:"|12|dynamiccertificate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easycontrolling.ru ()"; content:"|0f|easycontrolling|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easypanel.ru ()"; content:"|09|easypanel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enabler-actris.ru ()"; content:"|0e|enabler-actris|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feed-large.ru (Malware_Distribution)"; content:"|0a|feed-large|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-lots-poisk.ru (Malware_Distribution)"; content:"|0f|file-lots-poisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-many-file.ru (Malware_Distribution)"; content:"|0e|file-many-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-manylots.ru (Malware_Distribution)"; content:"|0d|file-manylots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-moment-download.ru (Malware_Distribution)"; content:"|14|file-moment-download|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-moment-find.ru (Malware_Distribution)"; content:"|10|file-moment-find|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-poisk-all.ru (Malware_Distribution)"; content:"|0e|file-poisk-all|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file-search-download.ru (Malware_Distribution)"; content:"|14|file-search-download|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filearchiv-file.ru (Malware_Distribution)"; content:"|0f|filearchiv-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filedownload-stuff.ru (Malware_Distribution)"; content:"|12|filedownload-stuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filefilefiles.ru (Malware_Distribution)"; content:"|0d|filefilefiles|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filefilesall.ru (Malware_Distribution)"; content:"|0c|filefilesall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileget-poisk.ru (Malware_Distribution)"; content:"|0d|fileget-poisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filehousedownload.ru (Malware_Distribution)"; content:"|11|filehousedownload|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files-alldownload.ru (Malware_Distribution)"; content:"|11|files-alldownload|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files-file-all.ru (Malware_Distribution)"; content:"|0e|files-file-all|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files-fileget.ru (Malware_Distribution)"; content:"|0d|files-fileget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files-get-find.ru (Malware_Distribution)"; content:"|0e|files-get-find|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files-house-lots.ru (Malware_Distribution)"; content:"|10|files-house-lots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files-searchall.ru (Malware_Distribution)"; content:"|0f|files-searchall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files-searchstuff.ru (Malware_Distribution)"; content:"|11|files-searchstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flyghtairline.ru ()"; content:"|0d|flyghtairline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup followmego12.ru (Malware_Distribution)"; content:"|0c|followmego12|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxyserverstats.com (Malware_Distribution)"; content:"|0f|foxyserverstats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fssdfhgs.coom.in (Botnet_C&C)"; content:"|08|fssdfhgs|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdasgdsa.c0m.li (Malware_Distribution)"; content:"|08|gdasgdsa|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodyear1.in (Malware_Distribution)"; content:"|09|goodyear1|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goooogle.osa.pl ()"; content:"|08|goooogle|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdfhrrreeeww.coom.in (Malware_Distribution)"; content:"|0c|hdfhrrreeeww|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgdch.nl.ai (Malware_Distribution)"; content:"|05|hgdch|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgdfhd.coom.in (Malware_Distribution)"; content:"|06|hgdfhd|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgdhgd.nl.ai (Malware_Distribution)"; content:"|06|hgdhgd|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hidemyfass87111.ru (Malware_Distribution)"; content:"|0f|hidemyfass87111|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjbh.nl.ai (Malware_Distribution)"; content:"|04|hjbh|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hzdgh.nl.ai (Malware_Distribution)"; content:"|05|hzdgh|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innvidn.com (Malware_Distribution)"; content:"|07|innvidn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jinomarket.ru ()"; content:"|0a|jinomarket|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jnhfj.nl.ai (Malware_Distribution)"; content:"|05|jnhfj|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jopek.fr.nf (Malware_Distribution)"; content:"|05|jopek|02|fr|02|nf"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justing.ru ()"; content:"|07|justing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juyfdjhdjdgh.nl.ai (Malware_Distribution)"; content:"|0c|juyfdjhdjdgh|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjgfg.nl.ai (Malware_Distribution)"; content:"|05|kjgfg|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjrhdggg.ce.ms (Malware_Distribution)"; content:"|08|kjrhdggg|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koletrezzo44.ru (Malware_Distribution)"; content:"|0c|koletrezzo44|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kollshi.com (Malware_Distribution)"; content:"|07|kollshi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lallygag.com (Malware_Distribution)"; content:"|08|lallygag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup largeprovider.ru ()"; content:"|0d|largeprovider|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lensesorganization.ru ()"; content:"|12|lensesorganization|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lensesproducing.ru ()"; content:"|0f|lensesproducing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liabilitysud.info (Malware_Distribution)"; content:"|0c|liabilitysud|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loginnewman.in ()"; content:"|0b|loginnewman|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup losokorot7621.ru (Malware_Distribution)"; content:"|0d|losokorot7621|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lupytehoq.com (Malware_Distribution)"; content:"|09|lupytehoq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macroscomfort.ru ()"; content:"|0d|macroscomfort|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamtumbochka766.ru (Malware_Distribution)"; content:"|0f|mamtumbochka766|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdelafcmncz.com (Malware_Distribution)"; content:"|0b|mdelafcmncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memoryeternal.ru ()"; content:"|0d|memoryeternal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mrsdl.com (Malware_Distribution)"; content:"|05|mrsdl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbcidbanncz.com (Malware_Distribution)"; content:"|0b|nbcidbanncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neraller.net (Malware_Distribution)"; content:"|08|neraller|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netox.biz (Malware_Infectors)"; content:"|05|netox|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkteaser.ru ()"; content:"|0d|networkteaser|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newmanlogin.in ()"; content:"|0b|newmanlogin|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nikbir09.ws (Malware_Distribution)"; content:"|08|nikbir09|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup office-electronic.in (Malware_Distribution)"; content:"|11|office-electronic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup office-settlement.ru ()"; content:"|11|office-settlement|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paybucks.ru ()"; content:"|08|paybucks|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peoria33884.cz.cc ()"; content:"|0b|peoria33884|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2649357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piersi-nijak.info (Malware_Distribution)"; content:"|0c|piersi-nijak|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup placecollocation.ru ()"; content:"|10|placecollocation|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup play6677.org (Malware_Distribution)"; content:"|08|play6677|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornhunt.de.ms (Malware_Distribution)"; content:"|08|pornhunt|02|de|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup programssafe.ru (Malware_Distribution)"; content:"|0c|programssafe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectholes.ru (Malware_Distribution)"; content:"|0c|protectholes|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup providerlarge.ru ()"; content:"|0d|providerlarge|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rorubyypide.ddns.name (Malware_Distribution)"; content:"|0b|rorubyypide|04|ddns|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundcube.bee.pl (Malware_Distribution)"; content:"|09|roundcube|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalminisites.com (Malware_Distribution)"; content:"|0e|royalminisites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selmiuz.net (Malware_Distribution)"; content:"|07|selmiuz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sentx3.co.cc (Malware_Distribution)"; content:"|06|sentx3|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopirs.com (Malware_Distribution)"; content:"|07|shopirs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sityshoping.ru ()"; content:"|0b|sityshoping|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skpillshx.ru (Malware_Distribution)"; content:"|09|skpillshx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snpillshx.ru (Malware_Distribution)"; content:"|09|snpillshx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softoxo.ru ()"; content:"|07|softoxo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somangcos.com (Malware_Distribution)"; content:"|09|somangcos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sosfa.com (Malware_Distribution)"; content:"|05|sosfa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starpacker.com (Malware_Distribution)"; content:"|0a|starpacker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starting-collocation.ru ()"; content:"|14|starting-collocation|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statsmy.com (Malware_Distribution)"; content:"|07|statsmy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stbjbpir.osa.pl ()"; content:"|08|stbjbpir|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storagesafe.ru (Malware_Distribution)"; content:"|0b|storagesafe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamingfracmap.com (Malware_Distribution)"; content:"|10|streamingfracmap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuff-getfind.ru (Malware_Distribution)"; content:"|0d|stuff-getfind|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teaser-network.ru ()"; content:"|0e|teaser-network|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tourscontract.ru ()"; content:"|0d|tourscontract|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unter.myz.info (Malware_Distribution)"; content:"|05|unter|03|myz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urande.com (Malware_Distribution)"; content:"|06|urande|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidimacontract.ru ()"; content:"|0e|vidimacontract|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waercomendsrard3s.com (Zeus_Zbot_SpyEye)"; content:"|11|waercomendsrard3s|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wertys.ru (Malware_Distribution)"; content:"|06|wertys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westcall.msk.ru ()"; content:"|08|westcall|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westoptic.com (Malware_Infectors)"; content:"|09|westoptic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westsinks.com (Malware_Distribution)"; content:"|09|westsinks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weuiruuu3332cc.orge.pl (Malware_Distribution)"; content:"|0e|weuiruuu3332cc|04|orge|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup white-billing.ru ()"; content:"|0d|white-billing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xfsoduoxfv.mrbasic.com ()"; content:"|0a|xfsoduoxfv|07|mrbasic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xjdvvo.mrbasic.com ()"; content:"|06|xjdvvo|07|mrbasic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thisisatest123abc.com ()"; content:"|11|thisisatest123abc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 42pf9631d.co.uk (Malware_Distribution)"; content:"|09|42pf9631d|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adslayer.net (Zeus_Zbot_SpyEye)"; content:"|08|adslayer|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajithnet.com (Malware_Distribution)"; content:"|08|ajithnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anycop.com (Malware_Distribution)"; content:"|06|anycop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquarigger.com (Malware_Distribution)"; content:"|0a|aquarigger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsoftics.ru (SEO_Fraud)"; content:"|0b|bestsoftics|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfhchjg.nl-web.net (Malware_Infectors)"; content:"|07|cfhchjg|06|nl-web|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup check-criminal-records.org (Malware_Distribution)"; content:"|16|check-criminal-records|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codemaster.co.kr (Malware_Distribution)"; content:"|0a|codemaster|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cunningpanda.com (Malware_Distribution)"; content:"|0c|cunningpanda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuoma.com (Malware_Distribution)"; content:"|05|cuoma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cycles3d.com (Malware_Distribution)"; content:"|08|cycles3d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfking.info ()"; content:"|06|dfking|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domain123456789.biz (Malware_Distribution)"; content:"|0f|domain123456789|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderquery.com (Malware_Distribution)"; content:"|0b|finderquery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holesprotect.ru ()"; content:"|0c|holesprotect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup housepoisk-find.ru (Malware_Distribution)"; content:"|0f|housepoisk-find|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hp-fax-service290.info ()"; content:"|11|hp-fax-service290|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hukastantions.com (SEO_Fraud)"; content:"|0d|hukastantions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hulknutmeg.org (Malware_Distribution)"; content:"|0a|hulknutmeg|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hungermouth.org (Malware_Distribution)"; content:"|0b|hungermouth|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyz.dzmj.no12u.bz (Malware_Infectors)"; content:"|03|hyz|04|dzmj|05|no12u|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justbigtoys.com (Malware_Distribution)"; content:"|0b|justbigtoys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kkosokoko.ru (Malware_Distribution)"; content:"|09|kkosokoko|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laboratory-security.ru (Malware_Distribution)"; content:"|13|laboratory-security|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laboratorypeace.ru (Malware_Distribution)"; content:"|0f|laboratorypeace|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masaskisoft.in ()"; content:"|0b|masaskisoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mastynk.pl (Malware_Distribution)"; content:"|07|mastynk|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maxcom-online.net (Malware_Distribution)"; content:"|0d|maxcom-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mozafakozan.ce.ms (SEO_Fraud)"; content:"|0b|mozafakozan|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neigh-bours.net (Malware_Distribution)"; content:"|0b|neigh-bours|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net411.com (Malware_Distribution)"; content:"|06|net411|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notnormalenterprises.com (Malware_Distribution)"; content:"|14|notnormalenterprises|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ojertdsa.345.pl (Malware_Distribution)"; content:"|08|ojertdsa|03|345|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ojykoteduqyd.bigmoney.biz (Malware_Distribution)"; content:"|0c|ojykoteduqyd|08|bigmoney|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olisee.de (Malware_Distribution)"; content:"|06|olisee|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onairob.be (Malware_Distribution)"; content:"|07|onairob|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opfxpills.ru (Malware_Distribution)"; content:"|09|opfxpills|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pagerage.com (Malware_Distribution)"; content:"|08|pagerage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pattinsondaily.ru (Malware_Distribution)"; content:"|0e|pattinsondaily|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pctuto.com (Malware_Distribution)"; content:"|06|pctuto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peace-security.ru (Malware_Distribution)"; content:"|0e|peace-security|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personaltr-scaner.rr.nu ()"; content:"|11|personaltr-scaner|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pics135-flash.sytes.net (Malware_Distribution)"; content:"|0d|pics135-flash|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinkpillar.com (Malware_Distribution)"; content:"|0a|pinkpillar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plasticspark.ru (Malware_Distribution)"; content:"|0c|plasticspark|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plastpel.com.br (Malware_Distribution)"; content:"|08|plastpel|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup provider-feed.ru (Malware_Distribution)"; content:"|0d|provider-feed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup queryscanone.com (Malware_Distribution)"; content:"|0c|queryscanone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raptr.com (Malware_Distribution)"; content:"|05|raptr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rdr.cz.cc ()"; content:"|03|rdr|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-laboratory.ru ()"; content:"|13|security-laboratory|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft2pc.com (Malware_Distribution)"; content:"|07|soft2pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spark-pay.ru (Malware_Distribution)"; content:"|09|spark-pay|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spark-plastic.ru (Malware_Distribution)"; content:"|0d|spark-plastic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spidernet-software.info (Malware_Distribution)"; content:"|12|spidernet-software|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-key-logger.com (Malware_Distribution)"; content:"|0e|spy-key-logger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuff-gethouse.ru (Malware_Distribution)"; content:"|0e|stuff-gethouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuff-momentpoisk.ru (Malware_Distribution)"; content:"|11|stuff-momentpoisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuff-poiskhouse.ru (Malware_Distribution)"; content:"|10|stuff-poiskhouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuffarchivlots.ru (Malware_Distribution)"; content:"|0f|stuffarchivlots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuffgetfind.ru (Malware_Distribution)"; content:"|0c|stuffgetfind|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweepstakesandcontestsinfo.com ()"; content:"|1a|sweepstakesandcontestsinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thechurchinthepark.org (Malware_Distribution)"; content:"|12|thechurchinthepark|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thesexygirls.net (Malware_Distribution)"; content:"|0c|thesexygirls|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tigger-cam.com (Malware_Distribution)"; content:"|0a|tigger-cam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trepair.org (Malware_Distribution)"; content:"|07|trepair|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trusted-plugins.com (Malware_Distribution)"; content:"|0f|trusted-plugins|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tujimiao8.com (Malware_Distribution)"; content:"|09|tujimiao8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uaeloot.com (Malware_Distribution)"; content:"|07|uaeloot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uiingg2.com ()"; content:"|07|uiingg2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unionpersonal.com.ar (Malware_Distribution)"; content:"|0d|unionpersonal|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websells.com (Malware_Distribution)"; content:"|08|websells|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whatsyourpoint.info (Malware_Distribution)"; content:"|0e|whatsyourpoint|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup white-shopping.com (Malware_Distribution)"; content:"|0e|white-shopping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-spy.com (Malware_Distribution)"; content:"|07|win-spy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowlet.co.kr (Malware_Distribution)"; content:"|09|windowlet|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wizsearch.co.kr (Malware_Distribution)"; content:"|09|wizsearch|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xlamonline.ru (SEO_Fraud)"; content:"|0a|xlamonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yamoutfamily.com (Malware_Distribution)"; content:"|0c|yamoutfamily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yinetahyte.com (Malware_Distribution)"; content:"|0a|yinetahyte|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youngzsoft.net (Malware_Distribution)"; content:"|0a|youngzsoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zango.com (Malware_Distribution)"; content:"|05|zango|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zejamuf.com (Malware_Distribution)"; content:"|07|zejamuf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zunegateway.com (Malware_Distribution)"; content:"|0b|zunegateway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 105vibe.com (Malware_Infectors)"; content:"|07|105vibe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 123homefree.org (Malware_Distribution)"; content:"|0b|123homefree|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1me.com (Malware_Distribution)"; content:"|03|1me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 360gw400.com (Malware_Distribution)"; content:"|08|360gw400|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4-links.net (Malware_Distribution)"; content:"|07|4-links|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7ail.org (Malware_Distribution)"; content:"|04|7ail|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abrak4.info (Malware_Distribution)"; content:"|06|abrak4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adsbwm.com ()"; content:"|06|adsbwm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adultvideogames.name (Malware_Distribution)"; content:"|0f|adultvideogames|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ags.com.pl (Malware_Distribution)"; content:"|03|ags|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antistop.com (Malware_Distribution)"; content:"|08|antistop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apoloxtube6.in (Malware_Distribution)"; content:"|0b|apoloxtube6|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appleblossomart.net (Malware_Distribution)"; content:"|0f|appleblossomart|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquasrc.com (Malware_Infectors)"; content:"|07|aquasrc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asianfairy.net (Malware_Distribution)"; content:"|0a|asianfairy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bighealthtree.com ()"; content:"|0d|bighealthtree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluesoftcenter.com (Malware_Distribution)"; content:"|0e|bluesoftcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bogotahotel.com.co (Malware_Distribution)"; content:"|0b|bogotahotel|03|com|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byxon.com (Malware_Distribution)"; content:"|05|byxon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chikka.im ()"; content:"|06|chikka|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleare.in ()"; content:"|06|cleare|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbsupporttech.com (Zeus_Zbot_SpyEye)"; content:"|0d|dbsupporttech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup debcapluesub.com (Spyware)"; content:"|0c|debcapluesub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup familytindoor.net (Malware_Distribution)"; content:"|0d|familytindoor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gjhg.nl-web.net (Malware_Distribution)"; content:"|04|gjhg|06|nl-web|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heppishopdrm.ru (Malware_Distribution)"; content:"|0c|heppishopdrm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup house-filelots.ru (Malware_Distribution)"; content:"|0e|house-filelots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup house-stuff-file.ru (Malware_Distribution)"; content:"|10|house-stuff-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup houseget-stuff.ru (Malware_Distribution)"; content:"|0e|houseget-stuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup houselots-all.ru (Malware_Distribution)"; content:"|0d|houselots-all|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup houselotspoisk.ru (Malware_Distribution)"; content:"|0e|houselotspoisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup housemomentget.ru (Malware_Distribution)"; content:"|0e|housemomentget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huniloz.com (Zeus_Zbot_SpyEye)"; content:"|07|huniloz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iframepay.com (Malware_Distribution)"; content:"|09|iframepay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijdesign.com.br (Malware_Infectors)"; content:"|08|ijdesign|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leriverolfunt.com (Spyware)"; content:"|0d|leriverolfunt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lookadd.com (Malware_Distribution)"; content:"|07|lookadd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milflesbianfree.in (Malware_Distribution)"; content:"|0f|milflesbianfree|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanitos99109.co.cc (Malware_Distribution)"; content:"|0c|nanitos99109|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup payment-glonas.in (Malware_Distribution)"; content:"|0e|payment-glonas|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmatrac.in (Malware_Infectors)"; content:"|0a|pharmatrac|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plohotrah.com (Malware_Distribution)"; content:"|09|plohotrah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rachaneeflowers.com (Malware_Distribution)"; content:"|0f|rachaneeflowers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rivai.biz (Malware_Distribution)"; content:"|05|rivai|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2101doms.co.cc (Malware_Distribution)"; content:"|0b|sec2101doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2102doms.co.cc (Malware_Distribution)"; content:"|0b|sec2102doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2103doms.co.cc (Malware_Distribution)"; content:"|0b|sec2103doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2104doms.co.cc (Malware_Distribution)"; content:"|0b|sec2104doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2105doms.co.cc (Malware_Distribution)"; content:"|0b|sec2105doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2106doms.co.cc (Malware_Distribution)"; content:"|0b|sec2106doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2107doms.co.cc (Malware_Distribution)"; content:"|0b|sec2107doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2108doms.co.cc (Malware_Distribution)"; content:"|0b|sec2108doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2109doms.co.cc (Malware_Distribution)"; content:"|0b|sec2109doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2110doms.co.cc (Malware_Distribution)"; content:"|0b|sec2110doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2111doms.co.cc (Malware_Distribution)"; content:"|0b|sec2111doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2112doms.co.cc (Malware_Distribution)"; content:"|0b|sec2112doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2113doms.co.cc (Malware_Distribution)"; content:"|0b|sec2113doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2114doms.co.cc (Malware_Distribution)"; content:"|0b|sec2114doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2115doms.co.cc (Malware_Distribution)"; content:"|0b|sec2115doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2116doms.co.cc (Malware_Distribution)"; content:"|0b|sec2116doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2117doms.co.cc (Malware_Distribution)"; content:"|0b|sec2117doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2118doms.co.cc (Malware_Distribution)"; content:"|0b|sec2118doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2140doms.co.cc (Malware_Distribution)"; content:"|0b|sec2140doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2141doms.co.cc (Malware_Distribution)"; content:"|0b|sec2141doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2143doms.co.cc (Malware_Distribution)"; content:"|0b|sec2143doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2144doms.co.cc (Malware_Distribution)"; content:"|0b|sec2144doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2145doms.co.cc (Malware_Distribution)"; content:"|0b|sec2145doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2146doms.co.cc (Malware_Distribution)"; content:"|0b|sec2146doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2147doms.co.cc (Malware_Distribution)"; content:"|0b|sec2147doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2148doms.co.cc (Malware_Distribution)"; content:"|0b|sec2148doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2149doms.co.cc (Malware_Distribution)"; content:"|0b|sec2149doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2150doms.co.cc (Malware_Distribution)"; content:"|0b|sec2150doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2151doms.co.cc (Malware_Distribution)"; content:"|0b|sec2151doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2159doms.co.cc (Malware_Distribution)"; content:"|0b|sec2159doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2161doms.co.cc (Malware_Distribution)"; content:"|0b|sec2161doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2164doms.co.cc (Malware_Distribution)"; content:"|0b|sec2164doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2166doms.co.cc (Malware_Distribution)"; content:"|0b|sec2166doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2167doms.co.cc (Malware_Distribution)"; content:"|0b|sec2167doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2168doms.co.cc (Malware_Distribution)"; content:"|0b|sec2168doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2169doms.co.cc (Malware_Distribution)"; content:"|0b|sec2169doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2171doms.co.cc (Malware_Distribution)"; content:"|0b|sec2171doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2174doms.co.cc (Malware_Distribution)"; content:"|0b|sec2174doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2177doms.co.cc (Malware_Distribution)"; content:"|0b|sec2177doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2178doms.co.cc (Malware_Distribution)"; content:"|0b|sec2178doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2180doms.co.cc (Malware_Distribution)"; content:"|0b|sec2180doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2182doms.co.cc (Malware_Distribution)"; content:"|0b|sec2182doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2183doms.co.cc (Malware_Distribution)"; content:"|0b|sec2183doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sec2185doms.co.cc (Malware_Distribution)"; content:"|0b|sec2185doms|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-tvoya.in (Malware_Distribution)"; content:"|0e|security-tvoya|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skidrowgames.co.uk (Zeus_Zbot_SpyEye)"; content:"|0c|skidrowgames|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-mahalai.in (Malware_Distribution)"; content:"|10|software-mahalai|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuffgetlots.ru (Malware_Distribution)"; content:"|0c|stuffgetlots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thegioiauto.biz (Malware_Infectors)"; content:"|0b|thegioiauto|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tixuanabridge.ru (Zeus_Zbot_SpyEye)"; content:"|0d|tixuanabridge|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tobuqycafukogyk.ygto.com (Malware_Distribution)"; content:"|0f|tobuqycafukogyk|04|ygto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubeporn.de.ms (Malware_Distribution)"; content:"|08|tubeporn|02|de|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhykayijidye.ygto.com (Malware_Distribution)"; content:"|0c|uhykayijidye|04|ygto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uklopandaberk.ru (Zeus_Zbot_SpyEye)"; content:"|0d|uklopandaberk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uksold.com (Malware_Infectors)"; content:"|06|uksold|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unitedvietship.com (Phishing_and_Theft)"; content:"|0e|unitedvietship|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update1.firstscannerm.com (Malware_Distribution)"; content:"|07|update1|0d|firstscannerm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkgosti.net (Malware_Distribution)"; content:"|07|vkgosti|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vmpp.comule.com (Malware_Distribution)"; content:"|04|vmpp|06|comule|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtechso.com (Malware_Distribution)"; content:"|0a|yourtechso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup znga.org (Malware_Distribution)"; content:"|04|znga|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zweex.com (Malware_Distribution)"; content:"|05|zweex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1oneok.ce.ms (Malware_Distribution)"; content:"|06|1oneok|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acez.com (Malware_Distribution)"; content:"|04|acez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adpenpussycurl.com ()"; content:"|0e|adpenpussycurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alyackorea.com (Malware_Distribution)"; content:"|0a|alyackorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amigosejogos.com (Malware_Distribution)"; content:"|0c|amigosejogos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup animalscountry.org (Malware_Distribution)"; content:"|0e|animalscountry|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiquesofsidcup.co.uk (Malware_Distribution)"; content:"|10|antiquesofsidcup|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aoaophoto.com (Malware_Distribution)"; content:"|09|aoaophoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asjdha903.co.cc (Malware_Distribution)"; content:"|09|asjdha903|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestnzb.com (Malware_Distribution)"; content:"|07|bestnzb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogvitimasblack.net (Malware_Distribution)"; content:"|10|blogvitimasblack|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bo610.com (Malware_Distribution)"; content:"|05|bo610|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cefalo.de (Malware_Distribution)"; content:"|06|cefalo|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collagecreator.info (Malware_Distribution)"; content:"|0e|collagecreator|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collagecreatorskachat.info (Malware_Distribution)"; content:"|15|collagecreatorskachat|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edcor.cx.cc (Malware_Distribution)"; content:"|05|edcor|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeesad.bget.ru (Malware_Distribution)"; content:"|06|eeesad|04|bget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enterobigtits.com ()"; content:"|0d|enterobigtits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertugrulakduman.com (Malware_Infectors)"; content:"|0f|ertugrulakduman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evenconc.ru ()"; content:"|08|evenconc|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extorld.ru ()"; content:"|07|extorld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairyfish.net (Malware_Distribution)"; content:"|09|fairyfish|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fenkaololo.com (Malware_Distribution)"; content:"|0a|fenkaololo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fg5f3iu5fti3utf5i3ut5iu3.nl.ai (Zeus_Zbot_SpyEye)"; content:"|18|fg5f3iu5fti3utf5i3ut5iu3|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fghrthn.cz.cc (Zeus_Zbot_SpyEye)"; content:"|07|fghrthn|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findfile-stuff.ru (Malware_Distribution)"; content:"|0e|findfile-stuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findfiledownload.ru (Malware_Distribution)"; content:"|10|findfiledownload|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findfilehouse.ru (Malware_Distribution)"; content:"|0d|findfilehouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getmilfs.com (Spyware)"; content:"|08|getmilfs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getmomenthouse.ru (Malware_Distribution)"; content:"|0e|getmomenthouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getmomentpoisk.ru (Malware_Distribution)"; content:"|0e|getmomentpoisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getstuff-files.ru (Malware_Distribution)"; content:"|0e|getstuff-files|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsshavingpal.com ()"; content:"|0f|girlsshavingpal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gmppussyicus.com ()"; content:"|0c|gmppussyicus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup house-file-lots.ru (Malware_Distribution)"; content:"|0f|house-file-lots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htfdfssfd.coom.in (Malware_Distribution)"; content:"|09|htfdfssfd|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imbingdo.ru ()"; content:"|08|imbingdo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup install-finder.com (Malware_Distribution)"; content:"|0e|install-finder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inverl.de (Malware_Distribution)"; content:"|06|inverl|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jmmaijia.com (Malware_Distribution)"; content:"|08|jmmaijia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juicepussyorbit.com ()"; content:"|0f|juicepussyorbit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kvicklyhelsinge.dk (Malware_Infectors)"; content:"|0f|kvicklyhelsinge|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letitbit.net (Malware_Distribution)"; content:"|08|letitbit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lionandyarnpartner.com ()"; content:"|12|lionandyarnpartner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamabearssoaps.com (Malware_Distribution)"; content:"|0e|mamabearssoaps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matocrossing.com (Malware_Infectors)"; content:"|0c|matocrossing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediamindcal.com (Malware_Distribution)"; content:"|0c|mediamindcal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup michellesflowersltd.co.uk (Malware_Infectors)"; content:"|13|michellesflowersltd|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mousboobsamigo.com ()"; content:"|0e|mousboobsamigo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muvinor.ru ()"; content:"|07|muvinor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-counter.co.cc (Malware_Distribution)"; content:"|0a|my-counter|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myescortsdirectory.com (Malware_Infectors)"; content:"|12|myescortsdirectory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ncestanimefriend.com ()"; content:"|10|ncestanimefriend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netosdesalim.com.br (Malware_Distribution)"; content:"|0c|netosdesalim|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsphoto.com (Malware_Distribution)"; content:"|09|newsphoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ni3ma-chat.com (Malware_Distribution)"; content:"|0a|ni3ma-chat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitconnect.net (Malware_Infectors)"; content:"|0a|nitconnect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nosyfan.ru (Botnet_C&C)"; content:"|07|nosyfan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novoalbumdefotos.com (Malware_Distribution)"; content:"|10|novoalbumdefotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oneathleticmom.com (Spyware)"; content:"|0e|oneathleticmom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oovoodownload.info (Malware_Distribution)"; content:"|0d|oovoodownload|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palmettodatabase.com (Malware_Distribution)"; content:"|10|palmettodatabase|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pecoran.ru ()"; content:"|07|pecoran|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poogatodf.com ()"; content:"|09|poogatodf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup preteensmoffbud.com ()"; content:"|0f|preteensmoffbud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup preteensmoskin.com ()"; content:"|0e|preteensmoskin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quanvbpl.vnbis.com (Malware_Distribution)"; content:"|08|quanvbpl|05|vnbis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rastemvtop.orge.pl (Malware_Distribution)"; content:"|0a|rastemvtop|04|orge|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ratemypenismate.com ()"; content:"|0f|ratemypenismate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rcub.ac.in (Malware_Distribution)"; content:"|04|rcub|02|ac|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rellmont.com (Malware_Distribution)"; content:"|08|rellmont|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjlsoftware.com (Malware_Distribution)"; content:"|0b|rjlsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rovotech.com (Malware_Distribution)"; content:"|08|rovotech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sentx14.co.cc (Malware_Infectors)"; content:"|07|sentx14|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexy-screen-savers.com (Malware_Distribution)"; content:"|12|sexy-screen-savers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shushev.ru ()"; content:"|07|shushev|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitedejogosonlines.com.br (Malware_Distribution)"; content:"|12|sitedejogosonlines|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softnsoft.com (Malware_Distribution)"; content:"|09|softnsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stmyst.com (Malware_Distribution)"; content:"|06|stmyst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysforme1069.co.cc (Malware_Distribution)"; content:"|0c|sysforme1069|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysforme1072.co.cc (Malware_Distribution)"; content:"|0c|sysforme1072|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysforme1092.co.cc (Malware_Distribution)"; content:"|0c|sysforme1092|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theasker.com (Malware_Distribution)"; content:"|08|theasker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titanpoker.com (Malware_Distribution)"; content:"|0a|titanpoker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toverlostremsstore.com (Malware_Distribution)"; content:"|12|toverlostremsstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uyqaykukoi.ddns.us (Malware_Distribution)"; content:"|0a|uyqaykukoi|04|ddns|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vik1952.ru (Malware_Distribution)"; content:"|07|vik1952|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webwizzard.info (Malware_Distribution)"; content:"|0a|webwizzard|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wefacerboook.com (Malware_Distribution)"; content:"|0c|wefacerboook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xgk8sus.ru (Malware_Infectors)"; content:"|07|xgk8sus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zanyquery.ru (Botnet_C&C)"; content:"|09|zanyquery|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zyns.com (Malware_Distribution)"; content:"|04|zyns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup az4.neostrada.pl (Malware_Distribution)"; content:"|03|az4|09|neostrada|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 26sg42oqx.co.cc (Malware_Distribution)"; content:"|09|26sg42oqx|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7gdfgdw.hopto.org (Malware_Distribution)"; content:"|07|7gdfgdw|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 80gm0aqht.box.tl (Malware_Distribution)"; content:"|09|80gm0aqht|03|box|02|tl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 91cpqd77h.co.cc (Malware_Distribution)"; content:"|09|91cpqd77h|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aacporn2.ru (Phishing_and_Theft)"; content:"|08|aacporn2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adekaacamcp.com (Malware_Distribution)"; content:"|0b|adekaacamcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adekancamcp.com (Malware_Distribution)"; content:"|0b|adekancamcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup affnhowy.c0m.li (Malware_Distribution)"; content:"|08|affnhowy|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afgrufiamcp.com (Malware_Distribution)"; content:"|0b|afgrufiamcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aialksdamcp.com (Malware_Distribution)"; content:"|0b|aialksdamcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alktramjc.com (Malware_Distribution)"; content:"|09|alktramjc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidpanties.info (Spyware)"; content:"|0e|androidpanties|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attnfeeniubm.com (Malware_Distribution)"; content:"|0c|attnfeeniubm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azurepaint.com (Malware_Distribution)"; content:"|0a|azurepaint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bagendestyf.com (Malware_Distribution)"; content:"|0b|bagendestyf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baredret.ru (Malware_Distribution)"; content:"|08|baredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup batebate.info ()"; content:"|08|batebate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbredret.ru (Malware_Distribution)"; content:"|08|bbredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bcredret.ru (Malware_Distribution)"; content:"|08|bcredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdredret.ru (Malware_Distribution)"; content:"|08|bdredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beaesa.rr.nu (Malware_Distribution)"; content:"|06|beaesa|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beredret.ru (Malware_Distribution)"; content:"|08|beredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-kgscanner.rr.nu (Malware_Distribution)"; content:"|0e|best-kgscanner|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestosa.rr.nu (Malware_Distribution)"; content:"|07|bestosa|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bfredret.ru (Malware_Distribution)"; content:"|08|bfredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bgredret.ru (Malware_Distribution)"; content:"|08|bgredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bhredret.ru (Malware_Distribution)"; content:"|08|bhredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biredret.ru (Malware_Distribution)"; content:"|08|biredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bjredret.ru (Malware_Distribution)"; content:"|08|bjredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bkredret.ru (Malware_Distribution)"; content:"|08|bkredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blammi.com (Malware_Distribution)"; content:"|06|blammi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blredret.ru (Malware_Distribution)"; content:"|08|blredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmredret.ru (Malware_Distribution)"; content:"|08|bmredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmyoodteoes.com (Malware_Distribution)"; content:"|0b|bmyoodteoes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bnredret.ru (Malware_Distribution)"; content:"|08|bnredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boredret.ru (Malware_Distribution)"; content:"|08|boredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxin.co.kr (Malware_Distribution)"; content:"|05|boxin|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bqredret.ru (Malware_Distribution)"; content:"|08|bqredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup breades.rr.nu (Malware_Distribution)"; content:"|07|breades|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brredret.ru (Malware_Distribution)"; content:"|08|brredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bsredret.ru (Malware_Distribution)"; content:"|08|bsredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup btredret.ru (Malware_Distribution)"; content:"|08|btredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buredret.ru (Malware_Distribution)"; content:"|08|buredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bvredret.ru (Malware_Distribution)"; content:"|08|bvredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bwredret.ru (Malware_Distribution)"; content:"|08|bwredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bxredret.ru (Malware_Distribution)"; content:"|08|bxredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byredret.ru (Malware_Distribution)"; content:"|08|byredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bzredret.ru (Malware_Distribution)"; content:"|08|bzredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cabalrider.net (Malware_Distribution)"; content:"|0a|cabalrider|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camplaces.net (Malware_Distribution)"; content:"|09|camplaces|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccdtphlcmcp.com (Malware_Distribution)"; content:"|0b|ccdtphlcmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celularbom.com (Malware_Distribution)"; content:"|0a|celularbom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup changjiu2.com (Malware_Distribution)"; content:"|09|changjiu2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cjoint.com (Malware_Distribution)"; content:"|06|cjoint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cmpstats.com (Malware_Infectors)"; content:"|08|cmpstats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dabcube.net (Malware_Infectors)"; content:"|07|dabcube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decalintos.com (Malware_Distribution)"; content:"|0a|decalintos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-tkwuq.box.tl (Malware_Distribution)"; content:"|0e|defender-tkwuq|03|box|02|tl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digistatsplace.com (Malware_Infectors)"; content:"|0e|digistatsplace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ditchyourip.com (Malware_Distribution)"; content:"|0b|ditchyourip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drj7oig.ru ()"; content:"|07|drj7oig|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup europjobs.eu (Fake_AV)"; content:"|09|europjobs|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expiredzone.ce.ms (Malware_Infectors)"; content:"|0b|expiredzone|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup favujib.webatu.com (Zeus_Zbot_SpyEye)"; content:"|07|favujib|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiberastat.com (Malware_Distribution)"; content:"|0a|fiberastat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesfind-house.ru (Malware_Distribution)"; content:"|0f|filesfind-house|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesfindhouse.ru (Malware_Distribution)"; content:"|0e|filesfindhouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesgetfile.ru (Malware_Distribution)"; content:"|0c|filesgetfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesmoment-download.ru (Malware_Distribution)"; content:"|14|filesmoment-download|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filespoiskdownload.ru (Malware_Distribution)"; content:"|12|filespoiskdownload|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filestuff-poisk.ru (Malware_Distribution)"; content:"|0f|filestuff-poisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filestuffhouse.ru (Malware_Distribution)"; content:"|0e|filestuffhouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup find-allhouse.ru (Malware_Distribution)"; content:"|0d|find-allhouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup find-archiv-file.ru (Malware_Distribution)"; content:"|10|find-archiv-file|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup find-archivpoisk.ru (Malware_Distribution)"; content:"|10|find-archivpoisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup find-filefiles.ru (Malware_Distribution)"; content:"|0e|find-filefiles|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup find-filemoment.ru (Malware_Distribution)"; content:"|0f|find-filemoment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup find-filesstuff.ru (Malware_Distribution)"; content:"|0f|find-filesstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fplvid2.ru (Malware_Infectors)"; content:"|07|fplvid2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeridershools.com (Malware_Distribution)"; content:"|0f|freeridershools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gifts.goodclicks.com (Malware_Infectors)"; content:"|05|gifts|0a|goodclicks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup headed.camppossibiliteas.org (Malware_Infectors)"; content:"|06|headed|11|camppossibiliteas|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hershypower.com (Zeus_Zbot_SpyEye)"; content:"|0b|hershypower|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highsta.com (Malware_Infectors)"; content:"|07|highsta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howareudoing56.com (Botnet_C&C)"; content:"|0e|howareudoing56|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibryte.com (Malware_Distribution)"; content:"|06|ibryte|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jimm-download.com (Malware_Distribution)"; content:"|0d|jimm-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobinhollandart.com (Fake_AV)"; content:"|0f|jobinhollandart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khytttttttt.coom.in (Malware_Distribution)"; content:"|0b|khytttttttt|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kindlyyoutyu67.info (Malware_Infectors)"; content:"|0e|kindlyyoutyu67|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kollend.com (Malware_Infectors)"; content:"|07|kollend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limfoklubs.com ()"; content:"|0a|limfoklubs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linmaxx.net (Zeus_Zbot_SpyEye)"; content:"|07|linmaxx|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ll0o9604rml.box.tl (Malware_Distribution)"; content:"|0b|ll0o9604rml|03|box|02|tl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lobsterliveverromez.com (Malware_Distribution)"; content:"|13|lobsterliveverromez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magesticgamers.com (Malware_Distribution)"; content:"|0e|magesticgamers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manitopercussion.com (Malware_Distribution)"; content:"|10|manitopercussion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mob2011.ru (Malware_Distribution)"; content:"|07|mob2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobile-mail-agent.ru (Malware_Distribution)"; content:"|11|mobile-mail-agent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobile-mamba.ru (Malware_Distribution)"; content:"|0c|mobile-mamba|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neoprenpillar.com (Malware_Distribution)"; content:"|0d|neoprenpillar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerflop.ontheweb.nu (Malware_Infectors)"; content:"|07|nerflop|08|ontheweb|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-mobile-skype.ru (Malware_Distribution)"; content:"|10|new-mobile-skype|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newhunter599.net ()"; content:"|0c|newhunter599|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-opera-mini.ru (Malware_Distribution)"; content:"|13|official-opera-mini|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ozbeachbikes.com (Zeus_Zbot_SpyEye)"; content:"|0c|ozbeachbikes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pisxzxe.qpoe.com (Spyware)"; content:"|07|pisxzxe|04|qpoe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plus500.com (Malware_Distribution)"; content:"|07|plus500|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premiumsafe.info (Malware_Distribution)"; content:"|0b|premiumsafe|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prime-vermond.ru (Malware_Distribution)"; content:"|0d|prime-vermond|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rautexton.com (Zeus_Zbot_SpyEye)"; content:"|09|rautexton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regfeedbackaccess.com (Malware_Infectors)"; content:"|11|regfeedbackaccess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup renamesys5.com (Malware_Infectors)"; content:"|0a|renamesys5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rumperstumprs.com (Malware_Distribution)"; content:"|0d|rumperstumprs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savesofthxe.rr.nu (Malware_Distribution)"; content:"|0b|savesofthxe|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savewm-holder.rr.nu (Malware_Distribution)"; content:"|0d|savewm-holder|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scdptqgsncz.com (Malware_Distribution)"; content:"|0b|scdptqgsncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seflkcdsmcp.com (Malware_Distribution)"; content:"|0b|seflkcdsmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serj4info.epac.to (Malware_Distribution)"; content:"|09|serj4info|04|epac|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serj6heror.dumb1.com (Malware_Distribution)"; content:"|0a|serj6heror|05|dumb1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serjfud2.ddns.me.uk (Malware_Distribution)"; content:"|08|serjfud2|04|ddns|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sextoys888.info (Malware_Infectors)"; content:"|0a|sextoys888|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simplecgantivir.rr.nu (Fake_AV)"; content:"|0f|simplecgantivir|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitechecker.coom.in (Malware_Infectors)"; content:"|0b|sitechecker|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sittueewfbel.com (Malware_Distribution)"; content:"|0c|sittueewfbel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sokadaf.webatu.com (Zeus_Zbot_SpyEye)"; content:"|07|sokadaf|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sqpresents.com (Malware_Infectors)"; content:"|0a|sqpresents|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssfoeitpkeel.com (Malware_Distribution)"; content:"|0c|ssfoeitpkeel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strong-checkercw.rr.nu (Malware_Distribution)"; content:"|10|strong-checkercw|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strongxwarmy.rr.nu (Malware_Distribution)"; content:"|0c|strongxwarmy|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syscave.com (Malware_Infectors)"; content:"|07|syscave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t5tgdd.hopto.org (Malware_Distribution)"; content:"|06|t5tgdd|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tahit.info (Spyware)"; content:"|05|tahit|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdosuegatil.com (Malware_Distribution)"; content:"|0b|tdosuegatil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telemonors.com (Malware_Infectors)"; content:"|0a|telemonors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebest-xlscanner.rr.nu (Malware_Distribution)"; content:"|11|thebest-xlscanner|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thfrh0zterszer.servequake.com (Malware_Distribution)"; content:"|0e|thfrh0zterszer|0a|servequake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titytsteconfh.com (Malware_Distribution)"; content:"|0d|titytsteconfh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toptasize.com (Malware_Infectors)"; content:"|09|toptasize|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackstatistics.com (Malware_Infectors)"; content:"|0f|trackstatistics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyzab.info (Spyware)"; content:"|05|tyzab|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uszyce.webd.pl (Malware_Distribution)"; content:"|06|uszyce|04|webd|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidosxxx-freex1a.ru ()"; content:"|10|vidosxxx-freex1a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vindictive.sisterlove.net (Malware_Infectors)"; content:"|0a|vindictive|0a|sisterlove|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visitmyblog.org (Zeus_Zbot_SpyEye)"; content:"|0b|visitmyblog|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vk-client.ru (Malware_Distribution)"; content:"|09|vk-client|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wdbvideo4.ru ()"; content:"|09|wdbvideo4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westarray.com (Zeus_Zbot_SpyEye)"; content:"|09|westarray|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup witlion.ru (Zeus_Zbot_SpyEye)"; content:"|07|witlion|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrkvid3.ru ()"; content:"|07|wrkvid3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x-porn-tube.net (Malware_Distribution)"; content:"|0b|x-porn-tube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xvideo-collection.com (Malware_Distribution)"; content:"|11|xvideo-collection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zbacrtehedel.com (Botnet_C&C)"; content:"|0c|zbacrtehedel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zqjporn7.ru (Phishing_and_Theft)"; content:"|08|zqjporn7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0nlinesecutity.com (Malware_Infectors)"; content:"|0e|0nlinesecutity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0riginalcheck.net (Malware_Distribution)"; content:"|0d|0riginalcheck|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 55nnobsineinsdf.tk (Malware_Distribution)"; content:"|0f|55nnobsineinsdf|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accredit-information.ru ()"; content:"|14|accredit-information|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeravine.com ()"; content:"|08|aeravine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allintercom.net ()"; content:"|0b|allintercom|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amarket.filesustore.com (Malware_Distribution)"; content:"|07|amarket|0b|filesustore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atlantawadding.ru (SEO_Fraud)"; content:"|0e|atlantawadding|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup audiocdfz.com (SEO_Fraud)"; content:"|09|audiocdfz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bezsvyazi.ru (Malware_Distribution)"; content:"|09|bezsvyazi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billiardniy.ru (SEO_Fraud)"; content:"|0b|billiardniy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biznesturizm148.ru (Botnet_C&C)"; content:"|0f|biznesturizm148|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonuscash.co.kr (Malware_Distribution)"; content:"|09|bonuscash|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cakerecipes.ru (SEO_Fraud)"; content:"|0b|cakerecipes|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cehmdysowfooe.com (Malware_Distribution)"; content:"|0d|cehmdysowfooe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cjikanccmcp.com (Malware_Distribution)"; content:"|0b|cjikanccmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contactfriendly.com ()"; content:"|0f|contactfriendly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corsair-logic.com (Malware_Distribution)"; content:"|0d|corsair-logic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dentsp.ru (Botnet_C&C)"; content:"|06|dentsp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dneottfatmny.com (Malware_Distribution)"; content:"|0c|dneottfatmny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domeafavour.ru (SEO_Fraud)"; content:"|0b|domeafavour|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eatingseedsforbetterlife.net ()"; content:"|18|eatingseedsforbetterlife|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eewqr12.servebeer.com (Malware_Distribution)"; content:"|07|eewqr12|09|servebeer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ej3leeed.com ()"; content:"|08|ej3leeed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ejipaohemcp.com (Malware_Distribution)"; content:"|0b|ejipaohemcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esuipb9.frneedyndns.in (Malware_Distribution)"; content:"|07|esuipb9|0b|frneedyndns|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everybodynames.org ()"; content:"|0e|everybodynames|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fargex.x9b.org (Malware_Distribution)"; content:"|06|fargex|03|x9b|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdqoeljhob.ce.ms (Malware_Distribution)"; content:"|0a|fdqoeljhob|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffffffffffffffffffff.cu.cc (Malware_Distribution)"; content:"|14|ffffffffffffffffffff|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filebay.com (Malware_Distribution)"; content:"|07|filebay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flowerdomax.ru (Botnet_C&C)"; content:"|0b|flowerdomax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fvdax.osa.pl (Malware_Distribution)"; content:"|05|fvdax|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geografycsturtup.in ()"; content:"|10|geografycsturtup|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup germanattention.org ()"; content:"|0f|germanattention|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlecheckoutcustomerservice.com (Phishing_and_Theft)"; content:"|1d|googlecheckoutcustomerservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup handsexual.com ()"; content:"|0a|handsexual|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-buy.ru ()"; content:"|08|hard-buy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howtoviewprivatefacebookpictures.com (Zeus_Zbot_SpyEye)"; content:"|20|howtoviewprivatefacebookpictures|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interestingchapter.net ()"; content:"|12|interestingchapter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup it98.org (Malware_Distribution)"; content:"|04|it98|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itisagooddaytodie.ru (SEO_Fraud)"; content:"|11|itisagooddaytodie|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjww.org (Malware_Distribution)"; content:"|04|jjww|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsadv.net ()"; content:"|05|jsadv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karaseal.ru (Botnet_C&C)"; content:"|08|karaseal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kudin.in (Malware_Distribution)"; content:"|05|kudin|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lewisentitled.com ()"; content:"|0d|lewisentitled|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makeasymoneyx.com (Malware_Distribution)"; content:"|0d|makeasymoneyx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makeitso.ru (SEO_Fraud)"; content:"|08|makeitso|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mastertraffic.org ()"; content:"|0d|mastertraffic|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdrrdl.com (Phishing_and_Theft)"; content:"|06|mdrrdl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediawhoerax.ru (Botnet_C&C)"; content:"|0c|mediawhoerax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaapload.net (Malware_Distribution)"; content:"|0a|megaapload|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mircsohbet.net (Malware_Distribution)"; content:"|0a|mircsohbet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mistyc-faraon.in ()"; content:"|0d|mistyc-faraon|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miwink.com (Malware_Distribution)"; content:"|06|miwink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mkdforce.org (Malware_Distribution)"; content:"|08|mkdforce|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3towav.org (Malware_Distribution)"; content:"|08|mp3towav|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msdmvdata.net ()"; content:"|09|msdmvdata|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtc-a.ru (Malware_Distribution)"; content:"|05|mtc-a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mustgoonax.ru (Botnet_C&C)"; content:"|0a|mustgoonax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mykeylogger.com (Malware_Distribution)"; content:"|0b|mykeylogger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n6104.co.kr (Malware_Distribution)"; content:"|05|n6104|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbxaudio.com (Malware_Distribution)"; content:"|08|nbxaudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neause.ru (Botnet_C&C)"; content:"|06|neause|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-studio.org (Malware_Distribution)"; content:"|0a|net-studio|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netnet51.com (Malware_Distribution)"; content:"|08|netnet51|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup off2off4sea.ru (Zeus_Zbot_SpyEye)"; content:"|0b|off2off4sea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oharifo.com (Malware_Distribution)"; content:"|07|oharifo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ok56gpnu99o.ce.ms ()"; content:"|0b|ok56gpnu99o|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinebizdirectory.com ()"; content:"|12|onlinebizdirectory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onnrypsieert.com (Malware_Distribution)"; content:"|0c|onnrypsieert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oopk.ru (Malware_Infectors)"; content:"|04|oopk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oroticorealty.com (Malware_Distribution)"; content:"|0d|oroticorealty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outlookconversion.com (Malware_Distribution)"; content:"|11|outlookconversion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pank.org (Malware_Distribution)"; content:"|04|pank|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pawsoft.com (Malware_Distribution)"; content:"|07|pawsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdf-word-converter.net (Malware_Distribution)"; content:"|12|pdf-word-converter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup philosophymercer.com ()"; content:"|10|philosophymercer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phlevelinmyblood.net ()"; content:"|10|phlevelinmyblood|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pixlygxe.qpoe.com (Malware_Distribution)"; content:"|08|pixlygxe|04|qpoe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup platrium.com (Malware_Distribution)"; content:"|08|platrium|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup postdone.com ()"; content:"|08|postdone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppzy.com (Malware_Distribution)"; content:"|04|ppzy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pulsuzwap.net (Malware_Distribution)"; content:"|09|pulsuzwap|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puskyaemancipation.info (Malware_Distribution)"; content:"|12|puskyaemancipation|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puzzle-game-download.com (Malware_Distribution)"; content:"|14|puzzle-game-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radiojovemrio.com (Malware_Distribution)"; content:"|0d|radiojovemrio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rateometer.com (Malware_Distribution)"; content:"|0a|rateometer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recoverlostpassword.com (Malware_Distribution)"; content:"|13|recoverlostpassword|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup renegadetech.com (Malware_Distribution)"; content:"|0c|renegadetech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup researchbits.com (Malware_Distribution)"; content:"|0c|researchbits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup resteda.in (Malware_Infectors)"; content:"|07|resteda|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup revplasmod.com (Malware_Distribution)"; content:"|0a|revplasmod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup risorsegiuste.com (Malware_Distribution)"; content:"|0d|risorsegiuste|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sandhuforgings.co.uk (Malware_Distribution)"; content:"|0e|sandhuforgings|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sandiegotoolbar.com (Malware_Distribution)"; content:"|0f|sandiegotoolbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup satogo.com (Malware_Distribution)"; content:"|06|satogo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-fuel-using-water.info (Malware_Distribution)"; content:"|15|save-fuel-using-water|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveinfo.co.kr (Malware_Distribution)"; content:"|08|saveinfo|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdex.ru ()"; content:"|04|sdex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchover.net (Malware_Distribution)"; content:"|0a|searchover|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sendqueriesax.ru (Botnet_C&C)"; content:"|0d|sendqueriesax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setting-appic.in ()"; content:"|0d|setting-appic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup settingappic.in ()"; content:"|0c|settingappic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartfind.co.kr (Malware_Distribution)"; content:"|09|smartfind|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snova-monday-work.net (Malware_Distribution)"; content:"|11|snova-monday-work|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spycop.kr (Malware_Distribution)"; content:"|06|spycop|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starpds.com (Malware_Distribution)"; content:"|07|starpds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statscon.net (Malware_Distribution)"; content:"|08|statscon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teethalong.org ()"; content:"|0a|teethalong|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topbanetw.rr.nu (Malware_Distribution)"; content:"|09|topbanetw|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topsentinelet.rr.nu (Malware_Distribution)"; content:"|0d|topsentinelet|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truenetseach.com ()"; content:"|0c|truenetseach|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trymedia.com (Malware_Distribution)"; content:"|08|trymedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tytahyousauo.com (Malware_Distribution)"; content:"|0c|tytahyousauo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup variuhetarala.com (Malware_Infectors)"; content:"|0d|variuhetarala|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watchingsquare.com ()"; content:"|0e|watchingsquare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup welcome-tome.com (SEO_Fraud)"; content:"|0c|welcome-tome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xchsztpr.cz.cc (Malware_Distribution)"; content:"|08|xchsztpr|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxnwa84ke.co.cc (Malware_Distribution)"; content:"|09|xxnwa84ke|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yespicture.org ()"; content:"|0a|yespicture|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourbrowsermatters.org (Malware_Distribution)"; content:"|12|yourbrowsermatters|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziphost.ro.lt (Malware_Distribution)"; content:"|07|ziphost|02|ro|02|lt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woprozorkow.pl (Malware_Distribution)"; content:"|0b|woprozorkow|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeroclub9.in (Malware_Distribution)"; content:"|09|aeroclub9|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup audio4fun.com (Malware_Distribution)"; content:"|09|audio4fun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b8c.su (Malware_Infectors)"; content:"|03|b8c|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup companian-usa.ru (Zeus_Zbot_SpyEye)"; content:"|0d|companian-usa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosoplumowen.com (Malware_Distribution)"; content:"|0c|cosoplumowen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eb4a91.com (Malware_Infectors)"; content:"|06|eb4a91|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f38.su (Malware_Infectors)"; content:"|03|f38|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f43595.com (Malware_Infectors)"; content:"|06|f43595|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f48.su (Malware_Infectors)"; content:"|03|f48|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f54eotoedko.info (Malware_Infectors)"; content:"|0b|f54eotoedko|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flowersinamew.com (Malware_Distribution)"; content:"|0d|flowersinamew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g26.su (Malware_Infectors)"; content:"|03|g26|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gewinngewinn.com (Malware_Distribution)"; content:"|0c|gewinngewinn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hacker.wz.cz (Malware_Distribution)"; content:"|06|hacker|02|wz|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hariomgroup.net (Malware_Distribution)"; content:"|0b|hariomgroup|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hers.com.hk (Malware_Distribution)"; content:"|04|hers|03|com|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hibatravel.org (Malware_Distribution)"; content:"|0a|hibatravel|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hidetools.com (Malware_Distribution)"; content:"|09|hidetools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup http-tunnel.com (Malware_Distribution)"; content:"|0b|http-tunnel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huzifatohov.com (Spyware)"; content:"|0b|huzifatohov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifdeaanidtcee.com (Malware_Distribution)"; content:"|0d|ifdeaanidtcee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igt.net (Malware_Distribution)"; content:"|03|igt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jghidcajncz.com (Malware_Distribution)"; content:"|0b|jghidcajncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kotsbplqf.tk (Malware_Distribution)"; content:"|09|kotsbplqf|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lilupophilupop.com (Malware_Distribution)"; content:"|0e|lilupophilupop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loseget.com (Malware_Distribution)"; content:"|07|loseget|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mildhotyou.org (Malware_Distribution)"; content:"|0a|mildhotyou|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n73.su (Malware_Infectors)"; content:"|03|n73|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phoneajoystick.ru (Zeus_Zbot_SpyEye)"; content:"|0e|phoneajoystick|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pofikpofikfikfik1.com (Zeus_Zbot_SpyEye)"; content:"|11|pofikpofikfikfik1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornvivid.info (Malware_Distribution)"; content:"|09|pornvivid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup road12street12.ru (Zeus_Zbot_SpyEye)"; content:"|0e|road12street12|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seawolbeamasa.com (Malware_Distribution)"; content:"|0d|seawolbeamasa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sirtukan.com (Malware_Distribution)"; content:"|08|sirtukan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tempdom9.info (Malware_Distribution)"; content:"|08|tempdom9|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v95.su (Malware_Infectors)"; content:"|03|v95|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvb.su (Malware_Infectors)"; content:"|03|vvb|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wdf55hoiio1.com (Zeus_Zbot_SpyEye)"; content:"|0b|wdf55hoiio1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webpigs.ru (Malware_Distribution)"; content:"|07|webpigs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wk8.su (Malware_Infectors)"; content:"|03|wk8|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaredret.ru (Malware_Distribution)"; content:"|08|aaredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abredret.ru (Malware_Distribution)"; content:"|08|abredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acredret.ru (Malware_Distribution)"; content:"|08|acredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adredret.ru (Malware_Distribution)"; content:"|08|adredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeredret.ru (Malware_Distribution)"; content:"|08|aeredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afredret.ru (Malware_Distribution)"; content:"|08|afredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agredret.ru (Malware_Distribution)"; content:"|08|agredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahredret.ru (Malware_Distribution)"; content:"|08|ahredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup airedret.ru (Malware_Distribution)"; content:"|08|airedret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajredret.ru (Malware_Distribution)"; content:"|08|ajredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akredret.ru (Malware_Distribution)"; content:"|08|akredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alredret.ru (Malware_Distribution)"; content:"|08|alredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amredret.ru (Malware_Distribution)"; content:"|08|amredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apredret.ru (Malware_Distribution)"; content:"|08|apredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aredret.ru (Malware_Distribution)"; content:"|07|aredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ation72histor.rr.nu (Malware_Distribution)"; content:"|0d|ation72histor|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestscanermcy.rr.nu (Malware_Distribution)"; content:"|0d|bestscanermcy|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crredret.ru (Malware_Distribution)"; content:"|08|crredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ctredret.ru (Malware_Distribution)"; content:"|08|ctredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curedret.ru (Malware_Distribution)"; content:"|08|curedret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup czredret.ru (Malware_Distribution)"; content:"|08|czredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezlifeinc.org (Malware_Distribution)"; content:"|09|ezlifeinc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firsttwiantivir.rr.nu (Fake_AV)"; content:"|0f|firsttwiantivir|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fourswsafe.rr.nu (Malware_Distribution)"; content:"|0a|fourswsafe|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freedownloadsoft.net (Malware_Distribution)"; content:"|10|freedownloadsoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshcompainoing.ce.ms (Malware_Distribution)"; content:"|10|freshcompainoing|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fsdhwtujtureu.cu.cc (Malware_Distribution)"; content:"|0d|fsdhwtujtureu|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fsuniversecf.quantcounter.com (Malware_Distribution)"; content:"|0c|fsuniversecf|0c|quantcounter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funnycode.co.kr (Malware_Distribution)"; content:"|09|funnycode|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funschoonerds.com (Malware_Distribution)"; content:"|0d|funschoonerds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fwzvslwcm.tk (Malware_Distribution)"; content:"|09|fwzvslwcm|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gent-filoz.serveirc.com (Malware_Distribution)"; content:"|0a|gent-filoz|08|serveirc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gfdgrrdwghjh.hopto.org (Malware_Distribution)"; content:"|0c|gfdgrrdwghjh|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gghjfyagmcp.com (Malware_Distribution)"; content:"|0b|gghjfyagmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ggs3ttyee.hopto.org (Malware_Distribution)"; content:"|09|ggs3ttyee|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gh654esd.hopto.org (Malware_Distribution)"; content:"|08|gh654esd|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghgdfgdfgdfgdf.hopto.org (Malware_Distribution)"; content:"|0e|ghgdfgdfgdfgdf|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goluboi.bee.pl (Malware_Distribution)"; content:"|07|goluboi|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gp-shop.cba.pl (Malware_Distribution)"; content:"|07|gp-shop|03|cba|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtemhtyatg.com (Malware_Distribution)"; content:"|0a|gtemhtyatg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtydscsanra.com (Malware_Distribution)"; content:"|0b|gtydscsanra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h45sddfsff4r4df.hopto.org (Malware_Distribution)"; content:"|0f|h45sddfsff4r4df|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h5rgdfgf.hopto.org (Malware_Distribution)"; content:"|08|h5rgdfgf|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haysttteeo.com (Malware_Distribution)"; content:"|0a|haysttteeo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdeff333.hopto.org (Malware_Distribution)"; content:"|08|hdeff333|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhhhfdds.hopto.org (Malware_Distribution)"; content:"|08|hhhhfdds|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hidesoft.net (Malware_Distribution)"; content:"|08|hidesoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjuffdrffff.hopto.org (Malware_Distribution)"; content:"|0b|hjuffdrffff|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup home.vicnet.net.au (Malware_Distribution)"; content:"|04|home|06|vicnet|03|net|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hp-driver.net (Malware_Distribution)"; content:"|09|hp-driver|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idleinside.com (Malware_Distribution)"; content:"|0a|idleinside|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idmbiz.com (Malware_Distribution)"; content:"|06|idmbiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inkasoft.com.tr (Malware_Distribution)"; content:"|08|inkasoft|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itappm.com (Malware_Distribution)"; content:"|06|itappm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j-cakes.com (Malware_Distribution)"; content:"|07|j-cakes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaufmannet.com (Malware_Distribution)"; content:"|0a|kaufmannet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingbot.net (Malware_Distribution)"; content:"|07|kingbot|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kpp234.com (Malware_Distribution)"; content:"|06|kpp234|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lhft-om.com (Malware_Distribution)"; content:"|07|lhft-om|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limpaxhub4x.tk (Malware_Distribution)"; content:"|0b|limpaxhub4x|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liston.co.kr (Malware_Distribution)"; content:"|06|liston|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ljokymgjhrt.com (Malware_Distribution)"; content:"|0b|ljokymgjhrt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lpetkblmf.ce.ms (Malware_Distribution)"; content:"|09|lpetkblmf|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microgaftnoipfack.ce.ms (Malware_Distribution)"; content:"|11|microgaftnoipfack|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mircmivso.orge.pl (Malware_Distribution)"; content:"|09|mircmivso|04|orge|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbnjkl.com (Malware_Distribution)"; content:"|06|nbnjkl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nostat.cu.cc (Malware_Distribution)"; content:"|06|nostat|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oabruhiomcp.com (Malware_Distribution)"; content:"|0b|oabruhiomcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obcidlaoncz.com (Malware_Distribution)"; content:"|0b|obcidlaoncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oeefrstsgaoyg.com (Malware_Distribution)"; content:"|0d|oeefrstsgaoyg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savepeantivir.rr.nu (Fake_AV)"; content:"|0d|savepeantivir|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seekmo.com (Malware_Distribution)"; content:"|06|seekmo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartndholder.rr.nu (Malware_Distribution)"; content:"|0d|smartndholder|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweepstakesandcontestsnow.com (Malware_Distribution)"; content:"|19|sweepstakesandcontestsnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youxi123.com (Malware_Distribution)"; content:"|08|youxi123|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 326435465.com (Malware_Distribution)"; content:"|09|326435465|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4analytics.ws (Fake_AV)"; content:"|0a|4analytics|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6tg56g5.osa.pl (Fake_AV)"; content:"|07|6tg56g5|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7-storage.com (Malware_Distribution)"; content:"|09|7-storage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9u7.cz.cc (Fake_AV)"; content:"|03|9u7|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaascreensavers.com (Malware_Distribution)"; content:"|0f|aaascreensavers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activecinnex.ru ()"; content:"|0c|activecinnex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ageoloft.info (Malware_Distribution)"; content:"|08|ageoloft|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agurinul12.ru (Malware_Infectors)"; content:"|0a|agurinul12|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allegiantstaff.com (Malware_Distribution)"; content:"|0e|allegiantstaff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avawg.com (Malware_Distribution)"; content:"|05|avawg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azond.ru ()"; content:"|05|azond|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bagogilu.hostoi.com (Zeus_Zbot_SpyEye)"; content:"|08|bagogilu|06|hostoi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-lady-clothes.biz (Malware_Distribution)"; content:"|11|best-lady-clothes|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bvsfjae.ce.ms (Fake_AV)"; content:"|07|bvsfjae|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caiualov.cz.cc (Fake_AV)"; content:"|08|caiualov|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cedicido.hostoi.com (Zeus_Zbot_SpyEye)"; content:"|08|cedicido|06|hostoi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup certerpen.info (Malware_Distribution)"; content:"|09|certerpen|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciredret.ru (Malware_Distribution)"; content:"|08|ciredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colmundoradio.com.co (Malware_Distribution)"; content:"|0d|colmundoradio|03|com|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combigave.com (Malware_Distribution)"; content:"|09|combigave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combijump.com (Malware_Distribution)"; content:"|09|combijump|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combimyself.com (Malware_Distribution)"; content:"|0b|combimyself|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combiplease.com (Malware_Distribution)"; content:"|0b|combiplease|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup config-connection.ru (Malware_Distribution)"; content:"|11|config-connection|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connection-masters.ru ()"; content:"|12|connection-masters|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup copytrans.net (Malware_Distribution)"; content:"|09|copytrans|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coredret.ru (Malware_Distribution)"; content:"|08|coredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crzyluxtds.in (Malware_Distribution)"; content:"|0a|crzyluxtds|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuidadus.com.br (Malware_Distribution)"; content:"|08|cuidadus|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyak.co.kr (Malware_Distribution)"; content:"|04|cyak|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup database-conversion.org (Malware_Distribution)"; content:"|13|database-conversion|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deneme.drturkiye.com (Malware_Distribution)"; content:"|06|deneme|09|drturkiye|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgftsfvvdfrtg.com (Malware_Distribution)"; content:"|0d|dgftsfvvdfrtg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgrtgsfdweq.com (Malware_Distribution)"; content:"|0b|dgrtgsfdweq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamllddncz.com (Malware_Distribution)"; content:"|0b|diamllddncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalcameradatarecovery.com (Malware_Distribution)"; content:"|19|digitalcameradatarecovery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dragosimport.com (Malware_Distribution)"; content:"|0c|dragosimport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egnom-omitec.ru (Malware_Distribution)"; content:"|0c|egnom-omitec|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emstock.com.cn (Malware_Distribution)"; content:"|07|emstock|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eozljijd.co.cc (Fake_AV)"; content:"|08|eozljijd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expressadvantage.net (SEO_Fraud)"; content:"|10|expressadvantage|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferrodisma.com (Malware_Distribution)"; content:"|0a|ferrodisma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgashdh.coom.in (Fake_AV)"; content:"|07|fgashdh|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finitysoft.com (Malware_Distribution)"; content:"|0a|finitysoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firmhansy.ru ()"; content:"|09|firmhansy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fjss.com (Malware_Distribution)"; content:"|04|fjss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup floreli.info (Malware_Distribution)"; content:"|07|floreli|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foochin.co.cc (Fake_AV)"; content:"|07|foochin|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foofranc.co.cc (Fake_AV)"; content:"|08|foofranc|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup formulasganacash.com (Malware_Distribution)"; content:"|10|formulasganacash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frameip.com (Malware_Distribution)"; content:"|07|frameip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabranits.com (Fake_AV)"; content:"|09|gabranits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genshop.org (Fake_AV)"; content:"|07|genshop|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gertalo8olw.c0m.li (Fake_AV)"; content:"|0b|gertalo8olw|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giqeheb.hostoi.com ()"; content:"|07|giqeheb|06|hostoi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodgirlsporn.com (Malware_Distribution)"; content:"|0d|goodgirlsporn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodwillpublicsecschool.com (Malware_Distribution)"; content:"|17|goodwillpublicsecschool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackfacebookpasswords.net (Malware_Distribution)"; content:"|15|hackfacebookpasswords|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdhdfhdfhdfh.ce.ms (Fake_AV)"; content:"|0c|hdhdfhdfhdfh|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hinet.net (Malware_Distribution)"; content:"|05|hinet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hljvip.net (Malware_Distribution)"; content:"|06|hljvip|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hogaa.com (Malware_Distribution)"; content:"|05|hogaa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibcosss.co.uk (Malware_Distribution)"; content:"|07|ibcosss|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insiderblog.co.cc (Malware_Distribution)"; content:"|0b|insiderblog|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jxxyshoping.com (Malware_Distribution)"; content:"|0b|jxxyshoping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaniserver.net (Malware_Distribution)"; content:"|0a|kaniserver|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laqeah.com (Malware_Distribution)"; content:"|06|laqeah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lottomeca.com (Malware_Distribution)"; content:"|09|lottomeca|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovemebaby.cz.cc (Fake_AV)"; content:"|0a|lovemebaby|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxelle.co.uk (Malware_Distribution)"; content:"|07|luxelle|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memothis.co.kr (Malware_Distribution)"; content:"|08|memothis|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysundayparty.com (Malware_Infectors)"; content:"|0d|mysundayparty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nemapivanemavodku1988.com (Malware_Distribution)"; content:"|15|nemapivanemavodku1988|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net9.org (Malware_Distribution)"; content:"|04|net9|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niceteenporn.com (Malware_Distribution)"; content:"|0c|niceteenporn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niudoudou.com (Malware_Distribution)"; content:"|09|niudoudou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odghhglq.servepics.com (Fake_AV)"; content:"|08|odghhglq|09|servepics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parahole.ru (Fake_AV)"; content:"|08|parahole|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcmegarapido.com (Malware_Distribution)"; content:"|0c|pcmegarapido|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pendosrulit.com (Fake_AV)"; content:"|0b|pendosrulit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharm.alltabstore.com (Fake_AV)"; content:"|05|pharm|0b|alltabstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prettylikeher.com (Malware_Infectors)"; content:"|0d|prettylikeher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profit-kilobics.ru ()"; content:"|0f|profit-kilobics|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profitkilobics.ru ()"; content:"|0e|profitkilobics|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-holes.ru (Malware_Distribution)"; content:"|0d|protect-holes|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwant-teory.ru ()"; content:"|0b|qwant-teory|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realcleaner.co.kr (Malware_Distribution)"; content:"|0b|realcleaner|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rebotstat.com (Fake_AV)"; content:"|09|rebotstat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rebtel.com (Malware_Distribution)"; content:"|06|rebtel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxsop.net (Malware_Distribution)"; content:"|05|rxsop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soaoo.blog-salopes.com (Malware_Distribution)"; content:"|05|soaoo|0c|blog-salopes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sqpxtgfd.redirectme.net (Fake_AV)"; content:"|08|sqpxtgfd|0a|redirectme|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stronghxochecker.rr.nu (Fake_AV)"; content:"|10|stronghxochecker|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telelope.com (Malware_Distribution)"; content:"|08|telelope|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toptenreport.com (Malware_Distribution)"; content:"|0c|toptenreport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradingcenter.cc (Botnet_C&C)"; content:"|0d|tradingcenter|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup troya.osa.pl (Fake_AV)"; content:"|05|troya|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turagambit.com (Malware_Distribution)"; content:"|0a|turagambit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ucclink.com (Malware_Distribution)"; content:"|07|ucclink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vippokers.com (Malware_Distribution)"; content:"|09|vippokers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkontakte-1-1.ru (Malware_Distribution)"; content:"|0d|vkontakte-1-1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vucigoge.hostoi.com (Zeus_Zbot_SpyEye)"; content:"|08|vucigoge|06|hostoi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webwatcherdata.com (Malware_Distribution)"; content:"|0e|webwatcherdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wonderfulwrench.com (Malware_Infectors)"; content:"|0f|wonderfulwrench|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwqwertyuiopasdfghjklcom.info (Malware_Distribution)"; content:"|19|wwwqwertyuiopasdfghjklcom|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xlfseeiuzy.net (Malware_Distribution)"; content:"|0a|xlfseeiuzy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--komrek-dxa.przeworsk.pl (Fake_AV)"; content:"|0e|xn--komrek-dxa|09|przeworsk|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--porczny-c9a.podhale.pl (Fake_AV)"; content:"|0f|xn--porczny-c9a|07|podhale|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoolnkd.com (Fake_AV)"; content:"|09|yahoolnkd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ynqgiligj.ce.ms (Fake_AV)"; content:"|09|ynqgiligj|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaebaliboti.net (Malware_Distribution)"; content:"|0b|zaebaliboti|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zqktswx.cz.cc (Fake_AV)"; content:"|07|zqktswx|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0window.com (Malware_Distribution)"; content:"|07|0window|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 523fsdfds.in (Zeus_Zbot_SpyEye)"; content:"|09|523fsdfds|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acrneglmobdep.com (Malware_Infectors)"; content:"|0d|acrneglmobdep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addiplus.com (Malware_Distribution)"; content:"|08|addiplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aleorew.com (Zeus_Zbot_SpyEye)"; content:"|07|aleorew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allegiantcare.com (Malware_Infectors)"; content:"|0d|allegiantcare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alphabrokerssr.com (Phishing_and_Theft)"; content:"|0e|alphabrokerssr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amloepolesen.com (Malware_Infectors)"; content:"|0c|amloepolesen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barringtonconsult.com (Phishing_and_Theft)"; content:"|11|barringtonconsult|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barringtonconsultancy.com (Phishing_and_Theft)"; content:"|15|barringtonconsultancy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackbmw.ru (Zeus_Zbot_SpyEye)"; content:"|08|blackbmw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bltradinggrp.com (Phishing_and_Theft)"; content:"|0c|bltradinggrp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup careconnectbyesco.com (Malware_Distribution)"; content:"|11|careconnectbyesco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccsmile.biz (Malware_Distribution)"; content:"|07|ccsmile|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebscreen.info (Malware_Distribution)"; content:"|0b|celebscreen|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centaur-advisors.com (Fake_AV)"; content:"|10|centaur-advisors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chicagobgllc.com (Phishing_and_Theft)"; content:"|0c|chicagobgllc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cinselcafe.com (Malware_Distribution)"; content:"|0a|cinselcafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cked.net (Malware_Distribution)"; content:"|04|cked|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cobato.com (Malware_Distribution)"; content:"|06|cobato|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computerbangalore.net (Malware_Distribution)"; content:"|11|computerbangalore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computerkolkata.com (Malware_Distribution)"; content:"|0f|computerkolkata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolbmw.ru (Zeus_Zbot_SpyEye)"; content:"|07|coolbmw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosplanet.com (Malware_Distribution)"; content:"|09|cosplanet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cp-africa.com (Malware_Distribution)"; content:"|09|cp-africa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crazyjd.co.cc (Malware_Distribution)"; content:"|07|crazyjd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daileysecurities.us (SEO_Fraud)"; content:"|10|daileysecurities|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakinderchor.org (Malware_Distribution)"; content:"|0c|dakinderchor|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dataservcorp.com (Malware_Distribution)"; content:"|0c|dataservcorp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drivers-updates.net (Malware_Distribution)"; content:"|0f|drivers-updates|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drookinabra.ru (Zeus_Zbot_SpyEye)"; content:"|0b|drookinabra|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecmolypecs.com (Malware_Infectors)"; content:"|0a|ecmolypecs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ehwjgfnbjqnsa.info (Malware_Distribution)"; content:"|0d|ehwjgfnbjqnsa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2657999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ejrklssfcc.com (Malware_Distribution)"; content:"|0a|ejrklssfcc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emeraldcoasturgentcare.com (Malware_Distribution)"; content:"|16|emeraldcoasturgentcare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eranpdctsemio.com (Malware_Infectors)"; content:"|0d|eranpdctsemio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersomeermnp.com (Malware_Infectors)"; content:"|0b|ersomeermnp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euskaljakintza.com (Malware_Distribution)"; content:"|0e|euskaljakintza|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgsdtsdbfuhdn.com (Malware_Distribution)"; content:"|0d|fgsdtsdbfuhdn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fhdysbvdcgvrwv.com (Malware_Distribution)"; content:"|0e|fhdysbvdcgvrwv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fhsfdrwcqwesdm.com (Malware_Distribution)"; content:"|0e|fhsfdrwcqwesdm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstprivateclients.com (Phishing_and_Theft)"; content:"|13|firstprivateclients|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup formaselectricas.com (Malware_Distribution)"; content:"|10|formaselectricas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fretolu.com (Zeus_Zbot_SpyEye)"; content:"|07|fretolu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamanagement.com (Phishing_and_Theft)"; content:"|0c|gamanagement|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotsoft.com (Malware_Distribution)"; content:"|07|gotsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenfieldconsultancy.com (Phishing_and_Theft)"; content:"|15|greenfieldconsultancy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenwayconsultancygrp.com (Phishing_and_Theft)"; content:"|16|greenwayconsultancygrp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grenfellassociates.com (Phishing_and_Theft)"; content:"|12|grenfellassociates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infoitpoweringgatheringit.com (Malware_Distribution)"; content:"|19|infoitpoweringgatheringit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johnsonsterlingconsultancy.com (Phishing_and_Theft)"; content:"|1a|johnsonsterlingconsultancy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kar20.ir (Malware_Distribution)"; content:"|05|kar20|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kpumu.myftp.org (Malware_Distribution)"; content:"|05|kpumu|05|myftp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kusalozus.com (Zeus_Zbot_SpyEye)"; content:"|09|kusalozus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup media-get.com (Malware_Distribution)"; content:"|09|media-get|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaget.com (Malware_Distribution)"; content:"|08|mediaget|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediatransfersltd.com (Phishing_and_Theft)"; content:"|11|mediatransfersltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millerconsultancyservices.com (Phishing_and_Theft)"; content:"|19|millerconsultancyservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morganpremiergrp.com (Phishing_and_Theft)"; content:"|10|morganpremiergrp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okxo-yktlkt.rr.nu (Malware_Distribution)"; content:"|0b|okxo-yktlkt|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olgibratoris.cu.cc (Malware_Distribution)"; content:"|0c|olgibratoris|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetubes24.com (Fake_AV)"; content:"|0d|onlinetubes24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oralania.com (Zeus_Zbot_SpyEye)"; content:"|08|oralania|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup passinggas.net (Malware_Distribution)"; content:"|0a|passinggas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdeqfrhpncz.com (Malware_Distribution)"; content:"|0b|pdeqfrhpncz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petersonconsultancy.com (Phishing_and_Theft)"; content:"|13|petersonconsultancy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup port-script.com (Malware_Distribution)"; content:"|0b|port-script|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qghjfjaqmcp.com (Malware_Distribution)"; content:"|0b|qghjfjaqmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjiaaarqmcp.com (Malware_Distribution)"; content:"|0b|qjiaaarqmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quattro-stagioni.it (Malware_Distribution)"; content:"|10|quattro-stagioni|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qzone6.com (Malware_Distribution)"; content:"|06|qzone6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raveoqarmy.rr.nu (Malware_Distribution)"; content:"|0a|raveoqarmy|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rstoontear.com (Malware_Distribution)"; content:"|0a|rstoontear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rubinp2p.com (Malware_Distribution)"; content:"|08|rubinp2p|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s3sdfsdfasd.mywww.biz (Malware_Distribution)"; content:"|0b|s3sdfsdfasd|05|mywww|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saefdesjvfdjukl.cu.cc (Malware_Distribution)"; content:"|0f|saefdesjvfdjukl|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-emmaster.rr.nu (Malware_Distribution)"; content:"|0d|safe-emmaster|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sanseverocommunity.com (Malware_Distribution)"; content:"|12|sanseverocommunity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup satdifnyet.com (Malware_Distribution)"; content:"|0a|satdifnyet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop-budz.com (Zeus_Zbot_SpyEye)"; content:"|09|shop-budz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somebackupdomain123.com (Zeus_Zbot_SpyEye)"; content:"|13|somebackupdomain123|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyfree.co.kr (Malware_Distribution)"; content:"|07|spyfree|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamindir.com (Malware_Distribution)"; content:"|08|tamindir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tatecarverconsultancy.com (Phishing_and_Theft)"; content:"|15|tatecarverconsultancy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thdx08.com (Malware_Distribution)"; content:"|06|thdx08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tolkachevphoto.ru (Zeus_Zbot_SpyEye)"; content:"|0e|tolkachevphoto|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-iicleaner.rr.nu (Malware_Distribution)"; content:"|0d|top-iicleaner|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackinganalytics.com (Malware_Infectors)"; content:"|11|trackinganalytics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrsfunding.com (Phishing_and_Theft)"; content:"|0a|vrsfunding|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warrenfisherassociates.com (Phishing_and_Theft)"; content:"|16|warrenfisherassociates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wdf55hoiio3.com (Zeus_Zbot_SpyEye)"; content:"|0b|wdf55hoiio3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winchesterconsultancygrp.com (Phishing_and_Theft)"; content:"|18|winchesterconsultancygrp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xabufiwaqa.pop3.ru (Malware_Distribution)"; content:"|0a|xabufiwaqa|04|pop3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoga-info.com.ua (Zeus_Zbot_SpyEye)"; content:"|09|yoga-info|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zddos.net (Malware_Distribution)"; content:"|05|zddos|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-hight.ru (Malware_Distribution)"; content:"|0a|soft-hight|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 369qy.com (Malware_Infectors)"; content:"|05|369qy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 79we7fsghdp98fhedcikhjd.com (Malware_Distribution)"; content:"|17|79we7fsghdp98fhedcikhjd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7we9fyhdc9uihfeuidhc.com (Malware_Distribution)"; content:"|14|7we9fyhdc9uihfeuidhc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahbazen.net (Malware_Distribution)"; content:"|07|ahbazen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amorcorsets.co.uk (Malware_Distribution)"; content:"|0b|amorcorsets|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artdecomirroredfurniture.co.uk (Malware_Distribution)"; content:"|18|artdecomirroredfurniture|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ashleybarnard.com (Malware_Distribution)"; content:"|0d|ashleybarnard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ashleysblog.co.uk (Malware_Distribution)"; content:"|0b|ashleysblog|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ashtreespharmacy.co.uk (Malware_Distribution)"; content:"|10|ashtreespharmacy|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b9pefwsiuhcdb8ogiuefdcdef.com (Malware_Distribution)"; content:"|19|b9pefwsiuhcdb8ogiuefdcdef|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baht.org.uk (Malware_Distribution)"; content:"|04|baht|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup batarryreanimayion.com ()"; content:"|12|batarryreanimayion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup batticani.com (Malware_Infectors)"; content:"|09|batticani|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbb-complains.org ()"; content:"|0d|bbb-complains|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedsidetablesfurniture.co.uk (Malware_Distribution)"; content:"|16|bedsidetablesfurniture|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedthese.com (Zeus_Zbot_SpyEye)"; content:"|08|bedthese|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betternewyear.ru (Botnet_C&C)"; content:"|0d|betternewyear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blank-record.com (Malware_Distribution)"; content:"|0c|blank-record|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bocventures.com (Phishing_and_Theft)"; content:"|0b|bocventures|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bridefatherspeech.co.uk (Malware_Distribution)"; content:"|11|bridefatherspeech|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bridegroomspeeches.co.uk (Malware_Distribution)"; content:"|12|bridegroomspeeches|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bridesfatherspeech.co.uk (Malware_Distribution)"; content:"|12|bridesfatherspeech|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunkhousesnowdonia.co.uk (Malware_Distribution)"; content:"|12|bunkhousesnowdonia|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carehomeconnect.co.uk (Malware_Distribution)"; content:"|0f|carehomeconnect|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cccstyle.in (Malware_Distribution)"; content:"|08|cccstyle|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celticvista.co.uk (Malware_Distribution)"; content:"|0b|celticvista|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chaucerfacilities.co.uk (Malware_Distribution)"; content:"|11|chaucerfacilities|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup childrensnurseryfurnitureandbeds.co.uk (Malware_Distribution)"; content:"|20|childrensnurseryfurnitureandbeds|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cliffhk.net (Malware_Distribution)"; content:"|07|cliffhk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coldclimbs.co.uk (Malware_Distribution)"; content:"|0a|coldclimbs|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup consoletablefurniture.co.uk (Malware_Distribution)"; content:"|15|consoletablefurniture|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corporateteambuildingcourses.co.uk (Malware_Distribution)"; content:"|1c|corporateteambuildingcourses|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfg5fdd34t.ce.ms (Malware_Infectors)"; content:"|0a|dfg5fdd34t|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doncasterlocksmiths.co.uk (Malware_Distribution)"; content:"|13|doncasterlocksmiths|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eakvideo6.ru ()"; content:"|09|eakvideo6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easyinchloss.net (Malware_Distribution)"; content:"|0c|easyinchloss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eden-fg.com (Phishing_and_Theft)"; content:"|07|eden-fg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edenvilleurope.com (Phishing_and_Theft)"; content:"|0e|edenvilleurope|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ehrman-loeb.com (Phishing_and_Theft)"; content:"|0b|ehrman-loeb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endeavorplan.com (Phishing_and_Theft)"; content:"|0c|endeavorplan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup energydevelopmentglobal.com (Phishing_and_Theft)"; content:"|17|energydevelopmentglobal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esilo.com (Malware_Distribution)"; content:"|05|esilo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etcsomsxls.com (Malware_Infectors)"; content:"|0a|etcsomsxls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etradex.com.hk (Phishing_and_Theft)"; content:"|07|etradex|03|com|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euroyenusd.com (Phishing_and_Theft)"; content:"|0a|euroyenusd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evansandstern.com (Phishing_and_Theft)"; content:"|0d|evansandstern|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evrymonthnighttry.com ()"; content:"|11|evrymonthnighttry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyapasomweicn.com (Malware_Infectors)"; content:"|0d|eyapasomweicn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f-easy.com (Phishing_and_Theft)"; content:"|06|f-easy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup factortenfinancial.com (Phishing_and_Theft)"; content:"|12|factortenfinancial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup famexfinancial.com (Phishing_and_Theft)"; content:"|0e|famexfinancial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasttrialpayments.com (Malware_Distribution)"; content:"|11|fasttrialpayments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalcap.us (Phishing_and_Theft)"; content:"|0a|federalcap|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feldmanmackiechan.com (Phishing_and_Theft)"; content:"|11|feldmanmackiechan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgfgddd.redirectme.net (Malware_Infectors)"; content:"|07|fgfgddd|0a|redirectme|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgfjhjg5rdfdf.no-ip.info (Malware_Infectors)"; content:"|0d|fgfjhjg5rdfdf|05|no-ip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup final-hurdle.com (Phishing_and_Theft)"; content:"|0c|final-hurdle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forgottensunrise.com (Malware_Distribution)"; content:"|10|forgottensunrise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frinova2005.com (Malware_Distribution)"; content:"|0b|frinova2005|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabymaus.ga.ohost.de (Malware_Distribution)"; content:"|08|gabymaus|02|ga|05|ohost|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamanagement.co.uk ()"; content:"|0c|gamanagement|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glasseseverydaynow.com ()"; content:"|12|glasseseverydaynow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gugla.org (Zeus_Zbot_SpyEye)"; content:"|05|gugla|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heyitsme.ru (SEO_Fraud)"; content:"|08|heyitsme|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup index117.com (Malware_Distribution)"; content:"|08|index117|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infoway.us (Malware_Distribution)"; content:"|07|infoway|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup issa-net.com (Malware_Distribution)"; content:"|08|issa-net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itmastersoft.narod.ru (Malware_Distribution)"; content:"|0c|itmastersoft|05|narod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jajahbinksdiesforyou.com (Malware_Distribution)"; content:"|14|jajahbinksdiesforyou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jardinesinvestment.com (Phishing_and_Theft)"; content:"|12|jardinesinvestment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lobsterliveverrolad.com (Zeus_Zbot_SpyEye)"; content:"|13|lobsterliveverrolad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makemealive.ru (SEO_Fraud)"; content:"|0b|makemealive|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypensionmoney.co.uk ()"; content:"|0e|mypensionmoney|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n8qfeuioahsnc09uohicn.com (Malware_Distribution)"; content:"|15|n8qfeuioahsnc09uohicn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n9ewufhsiocnp9uphid.com (Malware_Distribution)"; content:"|13|n9ewufhsiocnp9uphid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n9wefuhocn9dshifucn.com (Malware_Distribution)"; content:"|13|n9wefuhocn9dshifucn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup negro001.com ()"; content:"|08|negro001|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nwef9uhscji0wejofdmkc.com (Malware_Distribution)"; content:"|15|nwef9uhscji0wejofdmkc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinedesignerdirectory.com (Malware_Distribution)"; content:"|17|onlinedesignerdirectory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinewebdirectory.com (Malware_Distribution)"; content:"|12|onlinewebdirectory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pighair.ru (SEO_Fraud)"; content:"|07|pighair|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prominentfinancialsolutionz.info (Phishing_and_Theft)"; content:"|1b|prominentfinancialsolutionz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qgcporn3.ru ()"; content:"|08|qgcporn3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qq275.com (Malware_Distribution)"; content:"|05|qq275|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ragsmile.com (Malware_Distribution)"; content:"|08|ragsmile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ragsmog.com (Zeus_Zbot_SpyEye)"; content:"|07|ragsmog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ragsnip.com ()"; content:"|07|ragsnip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtyuj.in ()"; content:"|05|rtyuj|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skykeyboard2.ru (Botnet_C&C)"; content:"|0c|skykeyboard2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartcheat.ru (SEO_Fraud)"; content:"|0a|smartcheat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spark-send.ru (Zeus_Zbot_SpyEye)"; content:"|0a|spark-send|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup srv1.adsrvcpv.com (Malware_Distribution)"; content:"|04|srv1|08|adsrvcpv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trickip.org (Malware_Distribution)"; content:"|07|trickip|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usedconsoles.com (Malware_Distribution)"; content:"|0c|usedconsoles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vagex.com (Malware_Distribution)"; content:"|05|vagex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vampkeys.ru (SEO_Fraud)"; content:"|08|vampkeys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoxmx-onlina3e.ru ()"; content:"|11|videoxmx-onlina3e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vilarinomotor.com (Malware_Distribution)"; content:"|0d|vilarinomotor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-reporter.com (Fake_AV)"; content:"|0e|virus-reporter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7speed.info (Malware_Distribution)"; content:"|06|7speed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googglle.org (Malware_Distribution)"; content:"|08|googglle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iusav.com (Malware_Distribution)"; content:"|05|iusav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lessthenaminutehandle.com (Malware_Infectors)"; content:"|15|lessthenaminutehandle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwsqws3.co.cc (Malware_Distribution)"; content:"|07|qwsqws3|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsoftwareltd.ru (Malware_Distribution)"; content:"|0e|newsoftwareltd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup welcometotheglobaliscom.com (Malware_Distribution)"; content:"|17|welcometotheglobaliscom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1306a95ajbr.liga4giurgiu.info ()"; content:"|0b|1306a95ajbr|0c|liga4giurgiu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 897344kjdsf4523234.com (Malware_Distribution)"; content:"|12|897344kjdsf4523234|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 898234kjdsf4523234.com (Malware_Distribution)"; content:"|12|898234kjdsf4523234|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aboutconvert.ru ()"; content:"|0c|aboutconvert|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alias.jjbworks.com ()"; content:"|05|alias|08|jjbworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arcoconstalling.ru ()"; content:"|0f|arcoconstalling|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avtoremont.by (Malware_Distribution)"; content:"|0a|avtoremont|02|by"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best4you.if.ua ()"; content:"|08|best4you|02|if|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boobs-club.com (Malware_Distribution)"; content:"|0a|boobs-club|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bucks5.in (Malware_Distribution)"; content:"|06|bucks5|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bugs.chickenkiller.com (Malware_Distribution)"; content:"|04|bugs|0d|chickenkiller|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbredret.ru (Malware_Distribution)"; content:"|08|cbredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccredret.ru (Malware_Distribution)"; content:"|08|ccredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdredret.ru (Malware_Distribution)"; content:"|08|cdredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceredret.ru (Malware_Distribution)"; content:"|08|ceredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfredret.ru (Malware_Distribution)"; content:"|08|cfredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cgredret.ru (Malware_Distribution)"; content:"|08|cgredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chipiden.com (Malware_Distribution)"; content:"|08|chipiden|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chredret.ru (Malware_Distribution)"; content:"|08|chredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cjredret.ru (Malware_Distribution)"; content:"|08|cjredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckredret.ru (Malware_Distribution)"; content:"|08|ckredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clredret.ru (Malware_Distribution)"; content:"|08|clredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cmredret.ru (Malware_Distribution)"; content:"|08|cmredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnredret.ru (Malware_Distribution)"; content:"|08|cnredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup convertabout.ru ()"; content:"|0c|convertabout|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpredret.ru (Malware_Distribution)"; content:"|08|cpredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cqredret.ru (Malware_Distribution)"; content:"|08|cqredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cvredret.ru (Malware_Distribution)"; content:"|08|cvredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cwredret.ru (Malware_Distribution)"; content:"|08|cwredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxredret.ru (Malware_Distribution)"; content:"|08|cxredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyredret.ru (Malware_Distribution)"; content:"|08|cyredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digi-check.ru ()"; content:"|0a|digi-check|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadtube8videos.com (Malware_Distribution)"; content:"|13|downloadtube8videos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dplftomvader.com (Malware_Distribution)"; content:"|0c|dplftomvader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdmp4.net (Malware_Distribution)"; content:"|06|dvdmp4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easy2040.co.cc (Malware_Distribution)"; content:"|08|easy2040|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easy2047.co.cc (Malware_Distribution)"; content:"|08|easy2047|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easy2058.co.cc (Malware_Distribution)"; content:"|08|easy2058|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easy2062.co.cc (Malware_Distribution)"; content:"|08|easy2062|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebookforall.net (Malware_Distribution)"; content:"|0b|ebookforall|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebubekirgizligider.com (Malware_Distribution)"; content:"|12|ebubekirgizligider|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup efficiencytuhcrz.tk ()"; content:"|10|efficiencytuhcrz|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ek-kessons.co.cc (Malware_Distribution)"; content:"|0a|ek-kessons|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eldesaparecido.com (Malware_Distribution)"; content:"|0e|eldesaparecido|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ennior.net (Malware_Distribution)"; content:"|06|ennior|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epfm.net (Malware_Distribution)"; content:"|04|epfm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eqplusmag.com (Malware_Distribution)"; content:"|09|eqplusmag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eurogulftrading.com (Malware_Distribution)"; content:"|0f|eurogulftrading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezthemes.com (Malware_Distribution)"; content:"|08|ezthemes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2609944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faststonesoft.net (Malware_Distribution)"; content:"|0d|faststonesoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gfdjfgjhjhhghgh.c0m.li (Malware_Distribution)"; content:"|0f|gfdjfgjhjhhghgh|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup info.wifidns.org (Malware_Distribution)"; content:"|04|info|07|wifidns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup invisibill.net (Malware_Distribution)"; content:"|0a|invisibill|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup italianpop.com (Malware_Distribution)"; content:"|0a|italianpop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kardaizler.org (Malware_Distribution)"; content:"|0a|kardaizler|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kfatavistic.info (Malware_Distribution)"; content:"|0b|kfatavistic|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kokosina.in (Malware_Distribution)"; content:"|08|kokosina|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolossbanner.com (Malware_Distribution)"; content:"|0c|kolossbanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ktototamdaleko.com ()"; content:"|0e|ktototamdaleko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkghnfhyge.com (Malware_Distribution)"; content:"|0a|lkghnfhyge|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mal-waredoc.com (Malware_Distribution)"; content:"|0b|mal-waredoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mbkvjfnwydffs.com (Malware_Distribution)"; content:"|0d|mbkvjfnwydffs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtasa.com (Malware_Distribution)"; content:"|05|mtasa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ner-aller.org (Malware_Distribution)"; content:"|09|ner-aller|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-google.ce.ms ()"; content:"|0a|net-google|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nmwrdr.net (Malware_Distribution)"; content:"|06|nmwrdr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nnnhg.info (Malware_Distribution)"; content:"|05|nnnhg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ouyaoxiazai.com (Malware_Distribution)"; content:"|0b|ouyaoxiazai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjkshryyliability.info (Malware_Distribution)"; content:"|11|pjkshryyliability|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pqqpwjnmn.com (Malware_Distribution)"; content:"|09|pqqpwjnmn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwwsds.coldclimbs.co.uk (Malware_Distribution)"; content:"|06|qwwsds|0a|coldclimbs|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reach.emilioyepez.com ()"; content:"|05|reach|0b|emilioyepez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safetiantivir.kwik.to (Fake_AV)"; content:"|0d|safetiantivir|04|kwik|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sedvb.com (Malware_Distribution)"; content:"|05|sedvb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seks-planeta.com (Malware_Distribution)"; content:"|0c|seks-planeta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serving-sys1.com (Malware_Distribution)"; content:"|0c|serving-sys1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siambass.com (Malware_Distribution)"; content:"|08|siambass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tasfghbwevb.com (Malware_Distribution)"; content:"|0b|tasfghbwevb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tibiabot.com (Malware_Distribution)"; content:"|08|tibiabot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tittypalace.com (Malware_Distribution)"; content:"|0b|tittypalace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topguide.co.kr (Malware_Distribution)"; content:"|08|topguide|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twistloft.com (Malware_Infectors)"; content:"|09|twistloft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyjdfbdfh.bij.pl ()"; content:"|09|tyjdfbdfh|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyqw53tgdhsg.com (Malware_Distribution)"; content:"|0c|tyqw53tgdhsg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upleodcrrrs.com (Malware_Infectors)"; content:"|0b|upleodcrrrs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vxcetqyhknfnf.com (Malware_Distribution)"; content:"|0d|vxcetqyhknfnf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winner4.in (Malware_Distribution)"; content:"|07|winner4|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ybjpurwunjustified.info (Malware_Distribution)"; content:"|12|ybjpurwunjustified|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ymarloeoicc.com (Malware_Infectors)"; content:"|0b|ymarloeoicc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abedaso.in (Spyware)"; content:"|07|abedaso|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aliento.in (Spyware)"; content:"|07|aliento|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arnostov.cz (Malware_Distribution)"; content:"|08|arnostov|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astinkol.in (Spyware)"; content:"|08|astinkol|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup background-stylesheet.ru (Malware_Infectors)"; content:"|15|background-stylesheet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bamcayoyos.com (Malware_Infectors)"; content:"|0a|bamcayoyos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bloggerwidgets.cz.cc (Malware_Distribution)"; content:"|0e|bloggerwidgets|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boragore.in (Spyware)"; content:"|08|boragore|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brostuk.co.in (Spyware)"; content:"|07|brostuk|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cafgeas.c0m.li (Malware_Distribution)"; content:"|07|cafgeas|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cooltruling.ru (Zeus_Zbot_SpyEye)"; content:"|0b|cooltruling|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuewsdsd.c0m.li (Malware_Infectors)"; content:"|08|cuewsdsd|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curcell.net (Zeus_Zbot_SpyEye)"; content:"|07|curcell|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curvechurch.com (Malware_Distribution)"; content:"|0b|curvechurch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup date.moltensnightclub.com (Malware_Infectors)"; content:"|04|date|10|moltensnightclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dermex1.net (Malware_Infectors)"; content:"|07|dermex1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitusmarketing.com (Malware_Distribution)"; content:"|10|digitusmarketing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egorest.co.in (Spyware)"; content:"|07|egorest|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup falbumdinlermisin.org (Malware_Infectors)"; content:"|11|falbumdinlermisin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferdesa.in (Spyware)"; content:"|07|ferdesa|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flyakke.in (Spyware)"; content:"|07|flyakke|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup football.tatliyemektarifi.info (Malware_Infectors)"; content:"|08|football|10|tatliyemektarifi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foreston.in (Spyware)"; content:"|08|foreston|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frissccvtco.com (Malware_Infectors)"; content:"|0b|frissccvtco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geilebezahlung.eu (Phishing_and_Theft)"; content:"|0e|geilebezahlung|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gitaxo.com (Malware_Infectors)"; content:"|06|gitaxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gototrop.co.in (Spyware)"; content:"|08|gototrop|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup govern.bitkicesitleribulteni.com (Malware_Infectors)"; content:"|06|govern|15|bitkicesitleribulteni|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup headache.boyamburada.com (Malware_Infectors)"; content:"|08|headache|0b|boyamburada|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himpcaslnnooo.com (Malware_Infectors)"; content:"|0d|himpcaslnnooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikyjo.com (Malware_Distribution)"; content:"|05|ikyjo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intodub.in (Spyware)"; content:"|07|intodub|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irvengo.in (Spyware)"; content:"|07|irvengo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jitekite.webatu.com (Botnet_C&C)"; content:"|08|jitekite|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup judafus.webatu.com (Botnet_C&C)"; content:"|07|judafus|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kikvnmc.info (Malware_Distribution)"; content:"|07|kikvnmc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krundse.in (Spyware)"; content:"|07|krundse|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kucafuda.webatu.com (Botnet_C&C)"; content:"|08|kucafuda|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mancityloose.eu (Phishing_and_Theft)"; content:"|0c|mancityloose|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mendaly.in (Spyware)"; content:"|07|mendaly|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup menstro.in (Spyware)"; content:"|07|menstro|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mikeller.in (Spyware)"; content:"|08|mikeller|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mildruby.ru (SEO_Fraud)"; content:"|08|mildruby|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modernltd-uk.net (Phishing_and_Theft)"; content:"|0c|modernltd-uk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3dinlermisin.net (Malware_Infectors)"; content:"|0e|mp3dinlermisin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mumvron.in (Spyware)"; content:"|07|mumvron|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neutone.in (Spyware)"; content:"|07|neutone|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuowello.in (Spyware)"; content:"|08|nuowello|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peantos.in (Spyware)"; content:"|07|peantos|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pelosko.in (Spyware)"; content:"|07|pelosko|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piesdool.in (Spyware)"; content:"|08|piesdool|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pointroii.com (Malware_Distribution)"; content:"|09|pointroii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poruble.co.in (Spyware)"; content:"|07|poruble|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prhocgeascm.com (Malware_Infectors)"; content:"|0b|prhocgeascm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup priceandstonema.com (Phishing_and_Theft)"; content:"|0f|priceandstonema|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prime-commodities.com (Phishing_and_Theft)"; content:"|11|prime-commodities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privateequitytraders.sk (Phishing_and_Theft)"; content:"|14|privateequitytraders|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup procapman.com (Phishing_and_Theft)"; content:"|09|procapman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup provideofinancial.com (Phishing_and_Theft)"; content:"|11|provideofinancial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psesinda.in (Spyware)"; content:"|08|psesinda|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pustell.co.in (Spyware)"; content:"|07|pustell|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qofimefi.webatu.com (Botnet_C&C)"; content:"|08|qofimefi|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rainbol.in (Spyware)"; content:"|07|rainbol|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regalgroupinternational.com (Phishing_and_Theft)"; content:"|17|regalgroupinternational|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riseppomck.com (Malware_Infectors)"; content:"|0a|riseppomck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rms.adobe.com (Malware_Infectors)"; content:"|03|rms|05|adobe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roohiilocm.com (Malware_Infectors)"; content:"|0a|roohiilocm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rostets.in (Spyware)"; content:"|07|rostets|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sealove.in (Spyware)"; content:"|07|sealove|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportnichwetten.eu (Phishing_and_Theft)"; content:"|0f|sportnichwetten|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urdolast.in (Spyware)"; content:"|08|urdolast|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuvvideo4.ru (Phishing_and_Theft)"; content:"|09|vuvvideo4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsiteed.in (Spyware)"; content:"|07|wsiteed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdelbox.com (Malware_Infectors)"; content:"|07|xdelbox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xohunimu.hostzi.com (Botnet_C&C)"; content:"|08|xohunimu|06|hostzi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xsite-search.com (Malware_Infectors)"; content:"|0c|xsite-search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youporndump.com (Malware_Distribution)"; content:"|0b|youporndump|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourpandasecuritycheck.com (Malware_Infectors)"; content:"|16|yourpandasecuritycheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yukikuwa.webatu.com (Botnet_C&C)"; content:"|08|yukikuwa|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tkdirectory.com (Fake_AV)"; content:"|0b|tkdirectory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 100thingstodobeforeyoudie.org ()"; content:"|19|100thingstodobeforeyoudie|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aria3.in (Malware_Distribution)"; content:"|05|aria3|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-zoo-porn.com (Malware_Distribution)"; content:"|0d|best-zoo-porn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biggaxx.com (Malware_Distribution)"; content:"|07|biggaxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camnet-cm.info (Malware_Distribution)"; content:"|09|camnet-cm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccsnaioebom.com (Malware_Infectors)"; content:"|0b|ccsnaioebom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decaptcher.com ()"; content:"|0a|decaptcher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drcheck.net (Malware_Distribution)"; content:"|07|drcheck|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egorg.com ()"; content:"|05|egorg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup entrymania.com ()"; content:"|0a|entrymania|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estprom.ru (Malware_Distribution)"; content:"|07|estprom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast.albumdinlermisin.org (Malware_Infectors)"; content:"|04|fast|10|albumdinlermisin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fatohoza.webatu.com (Zeus_Zbot_SpyEye)"; content:"|08|fatohoza|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finish.mp3dinlermisin.net (Malware_Infectors)"; content:"|06|finish|0e|mp3dinlermisin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icresoctmlo.com (Malware_Infectors)"; content:"|0b|icresoctmlo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inferno3.net (Malware_Distribution)"; content:"|08|inferno3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inigopbrto.com (Malware_Infectors)"; content:"|0a|inigopbrto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irexsystems2011a.ru (Malware_Distribution)"; content:"|10|irexsystems2011a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irsmleonrboet.com (Malware_Infectors)"; content:"|0d|irsmleonrboet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jutdfgdf.ce.ms (Malware_Infectors)"; content:"|08|jutdfgdf|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kocepovi.webatu.com (Zeus_Zbot_SpyEye)"; content:"|08|kocepovi|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lemupooooc.com (Malware_Infectors)"; content:"|0a|lemupooooc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ltmarsnpcew.com (Malware_Infectors)"; content:"|0b|ltmarsnpcew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lxoeyiscrao.com (Malware_Infectors)"; content:"|0b|lxoeyiscrao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motmcopcaercs.com (Malware_Infectors)"; content:"|0d|motmcopcaercs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mpmiyhdaans.com (Malware_Infectors)"; content:"|0b|mpmiyhdaans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup munaeghohz.ru (Malware_Distribution)"; content:"|0a|munaeghohz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mutras.in ()"; content:"|06|mutras|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nahwisohch.ru (Malware_Distribution)"; content:"|0a|nahwisohch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nempesrsrioic.com (Malware_Infectors)"; content:"|0d|nempesrsrioic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nscoermcpeaei.com (Malware_Infectors)"; content:"|0d|nscoermcpeaei|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oceosarebrps.com (Malware_Infectors)"; content:"|0c|oceosarebrps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogpertqeytagahert.com (Spyware)"; content:"|11|ogpertqeytagahert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup optoincpsige.com (Malware_Infectors)"; content:"|0c|optoincpsige|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pestghcmmo.com (Malware_Infectors)"; content:"|0a|pestghcmmo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pixprofit.com ()"; content:"|09|pixprofit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pznpolice.pl (Malware_Distribution)"; content:"|09|pznpolice|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qubik.com (Malware_Distribution)"; content:"|05|qubik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refunadositol15.ru (Malware_Distribution)"; content:"|0f|refunadositol15|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registryrecords.org ()"; content:"|0f|registryrecords|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rikadirect.com (Malware_Distribution)"; content:"|0a|rikadirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rosedalolandou.com (Spyware)"; content:"|0e|rosedalolandou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rutraff.net (Malware_Distribution)"; content:"|07|rutraff|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-armyurp.rr.nu (Malware_Infectors)"; content:"|0c|save-armyurp|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servicemarker.com (Malware_Distribution)"; content:"|0d|servicemarker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serving-tracking.com (Malware_Distribution)"; content:"|10|serving-tracking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacetimeads.com (Malware_Distribution)"; content:"|0c|spacetimeads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toto888.gnway.net (Malware_Distribution)"; content:"|07|toto888|05|gnway|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trousers.in (Malware_Distribution)"; content:"|08|trousers|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turecimu.webatu.com (Zeus_Zbot_SpyEye)"; content:"|08|turecimu|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ushbrenerw.net (Spyware)"; content:"|0a|ushbrenerw|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wa-network.com (Malware_Distribution)"; content:"|0a|wa-network|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watefronwhits.com (Spyware)"; content:"|0d|watefronwhits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windermubousega.com (Spyware)"; content:"|0f|windermubousega|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winrardownload.info ()"; content:"|0e|winrardownload|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahooads1.in (Malware_Distribution)"; content:"|09|yahooads1|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youngzoosex.com (Malware_Distribution)"; content:"|0b|youngzoosex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeroxcode.net (Botnet_C&C)"; content:"|09|zeroxcode|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zkncfiqohdfsdas.com (Malware_Distribution)"; content:"|0f|zkncfiqohdfsdas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup focustemplate.ru (Malware_Distribution)"; content:"|0d|focustemplate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0-0-0.info (Malware_Distribution)"; content:"|05|0-0-0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a9rhiwa.cn (Malware_Distribution)"; content:"|07|a9rhiwa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adimgsn03.co.in (Malware_Distribution)"; content:"|09|adimgsn03|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adrive.co.kr (Malware_Distribution)"; content:"|06|adrive|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afa521.com (Malware_Infectors)"; content:"|06|afa521|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup age-ega.ru (Malware_Distribution)"; content:"|07|age-ega|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arturpirogkov.bij.pl ()"; content:"|0d|arturpirogkov|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baddowhall.net (Malware_Distribution)"; content:"|0a|baddowhall|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basanthkeerthi.com (Malware_Distribution)"; content:"|0e|basanthkeerthi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bongo.3d-game.com ()"; content:"|05|bongo|07|3d-game|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c1z.at (Malware_Distribution)"; content:"|03|c1z|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c3stat.com (Malware_Distribution)"; content:"|06|c3stat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c3statistic.com (Malware_Distribution)"; content:"|0b|c3statistic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cainoz.com (Malware_Distribution)"; content:"|06|cainoz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canfm.info (Malware_Distribution)"; content:"|05|canfm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cikojavif.com (Malware_Distribution)"; content:"|09|cikojavif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combi-justing.ru (Malware_Distribution)"; content:"|0d|combi-justing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comstnetwork.com (Malware_Distribution)"; content:"|0c|comstnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crystmassoft1.net (Malware_Distribution)"; content:"|0d|crystmassoft1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutaiamortgagegroup.cn (Malware_Distribution)"; content:"|13|cutaiamortgagegroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directlinkq.cn (Malware_Distribution)"; content:"|0b|directlinkq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dllink.alwaysdata.net (Malware_Distribution)"; content:"|06|dllink|0a|alwaysdata|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drvir.net (Malware_Distribution)"; content:"|05|drvir|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drwon.net (Malware_Distribution)"; content:"|05|drwon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup echip.com.vn (Malware_Distribution)"; content:"|05|echip|03|com|02|vn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fanegim.webatu.com (Zeus_Zbot_SpyEye)"; content:"|07|fanegim|06|webatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findmoreprofit.com (Zeus_Zbot_SpyEye)"; content:"|0e|findmoreprofit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genius-memory.ru (Malware_Distribution)"; content:"|0d|genius-memory|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go00ogle.net (Malware_Distribution)"; content:"|08|go00ogle|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlecounter.in (Malware_Distribution)"; content:"|0d|googlecounter|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grad-gray.ru ()"; content:"|09|grad-gray|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guahanmantratapa.com (Malware_Distribution)"; content:"|10|guahanmantratapa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gylleneting.se (Malware_Distribution)"; content:"|0b|gylleneting|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iatselocal98.osa.pl (Malware_Distribution)"; content:"|0c|iatselocal98|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iebar.t2t2.com (Malware_Distribution)"; content:"|05|iebar|04|t2t2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jennysweeta.osa.pl (Malware_Distribution)"; content:"|0b|jennysweeta|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johnsonforums3.com (Zeus_Zbot_SpyEye)"; content:"|0e|johnsonforums3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kakashke.ru ()"; content:"|08|kakashke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kurdistannet.net (Malware_Distribution)"; content:"|0c|kurdistannet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latinitjobs.net (Malware_Distribution)"; content:"|0b|latinitjobs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liga4giurgiu.info (Malware_Distribution)"; content:"|0c|liga4giurgiu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linotstroy.ru ()"; content:"|0a|linotstroy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ljgpxmsdporg.com (Malware_Distribution)"; content:"|0c|ljgpxmsdporg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup localh0st.info (Zeus_Zbot_SpyEye)"; content:"|09|localh0st|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luyhbvnovel.info (Malware_Infectors)"; content:"|0b|luyhbvnovel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marketingvillage.ru (Malware_Distribution)"; content:"|10|marketingvillage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup million-one.net (Malware_Distribution)"; content:"|0b|million-one|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mistressmochalove.com (Malware_Infectors)"; content:"|11|mistressmochalove|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morettistats.com (Malware_Distribution)"; content:"|0c|morettistats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newesy.kwik.to (Malware_Distribution)"; content:"|06|newesy|04|kwik|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novelcsuvnvwo.info (Malware_Infectors)"; content:"|0d|novelcsuvnvwo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novelefazg.info (Malware_Infectors)"; content:"|0a|novelefazg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novelrcjwp.info (Malware_Infectors)"; content:"|0a|novelrcjwp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odyjiez.cn (Malware_Distribution)"; content:"|07|odyjiez|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesecurytytests.ru (Malware_Distribution)"; content:"|13|onlinesecurytytests|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overthehedgemovie.com (Malware_Distribution)"; content:"|11|overthehedgemovie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partyparafunalia.net (Malware_Distribution)"; content:"|10|partyparafunalia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piramidspeed.in (Malware_Distribution)"; content:"|0c|piramidspeed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plasticalsex.ru (Malware_Distribution)"; content:"|0c|plasticalsex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pointroil.com (Malware_Distribution)"; content:"|09|pointroil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup postestatistic-online.in (Botnet_C&C)"; content:"|15|postestatistic-online|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rknetsk.com (Malware_Distribution)"; content:"|07|rknetsk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rthlsinks.cz.cc (Malware_Distribution)"; content:"|09|rthlsinks|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serviceocean.net (Malware_Distribution)"; content:"|0c|serviceocean|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serving-sys.org (Malware_Distribution)"; content:"|0b|serving-sys|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servling-sys.com (Malware_Distribution)"; content:"|0c|servling-sys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servlng-sys.com (Malware_Distribution)"; content:"|0b|servlng-sys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjpyfnpm.cn (Malware_Distribution)"; content:"|08|sjpyfnpm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skatevideoz.com (Malware_Distribution)"; content:"|0b|skatevideoz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacetime-tracking.com (Malware_Distribution)"; content:"|12|spacetime-tracking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup star-trakers.com ()"; content:"|0c|star-trakers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup staticdupdate.com (Malware_Distribution)"; content:"|0d|staticdupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statsncount.bz.cm (Malware_Distribution)"; content:"|0b|statsncount|02|bz|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stepkyrort.info (Malware_Distribution)"; content:"|0a|stepkyrort|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stylesheet-record.ru ()"; content:"|11|stylesheet-record|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stylesheethas.ru ()"; content:"|0d|stylesheethas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supportline911-911postonline.in (Zeus_Zbot_SpyEye)"; content:"|1c|supportline911-911postonline|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweepstakesandcontestsdo.com (Malware_Distribution)"; content:"|18|sweepstakesandcontestsdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tectiljob.ru (Malware_Distribution)"; content:"|09|tectiljob|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tendenciasideais.com (Malware_Distribution)"; content:"|10|tendenciasideais|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testmeforsecurity.ru (Malware_Distribution)"; content:"|11|testmeforsecurity|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topsofttx.kwik.to (Malware_Distribution)"; content:"|09|topsofttx|04|kwik|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup villiam-grea.ru (SEO_Fraud)"; content:"|0c|villiam-grea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wapgam.narod.ru (Malware_Distribution)"; content:"|06|wapgam|05|narod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wikewikusl.ru (Malware_Distribution)"; content:"|0a|wikewikusl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winupdate.phpnet.us (Malware_Distribution)"; content:"|09|winupdate|06|phpnet|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xludakx.com ()"; content:"|07|xludakx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpiwsrpdnovel.info (Malware_Infectors)"; content:"|0d|xpiwsrpdnovel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yukon2011.ru (Malware_Distribution)"; content:"|09|yukon2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yumalicious.com (Malware_Distribution)"; content:"|0b|yumalicious|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zerberzerberze.ru (Malware_Distribution)"; content:"|0e|zerberzerberze|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yu678.com (Malware_Distribution)"; content:"|05|yu678|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 34165.info (Malware_Distribution)"; content:"|05|34165|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abhhcbbic.co.cc (Malware_Infectors)"; content:"|09|abhhcbbic|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad79.co.kr (Malware_Distribution)"; content:"|04|ad79|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anezscape.0fees.net (Malware_Infectors)"; content:"|09|anezscape|05|0fees|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aspo2h3bvrcd.com (Malware_Infectors)"; content:"|0c|aspo2h3bvrcd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-softg.kwik.to (Malware_Distribution)"; content:"|0a|best-softg|04|kwik|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogsvk.ru (Malware_Distribution)"; content:"|07|blogsvk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmaster.in (Spyware)"; content:"|07|bmaster|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cliffordtravel.biz (Malware_Distribution)"; content:"|0e|cliffordtravel|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comm98andsp.rr.nu (Malware_Distribution)"; content:"|0b|comm98andsp|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doutl31inesst.rr.nu (Malware_Distribution)"; content:"|0d|doutl31inesst|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earni61ngunde.rr.nu (Malware_Distribution)"; content:"|0d|earni61ngunde|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ensm60erch.rr.nu (Malware_Distribution)"; content:"|0a|ensm60erch|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eorge00gamee.rr.nu (Malware_Distribution)"; content:"|0c|eorge00gamee|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eramsitioweb.com.ar (Malware_Distribution)"; content:"|0c|eramsitioweb|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ggesti51ngbina.rr.nu (Malware_Distribution)"; content:"|0e|ggesti51ngbina|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-adsenc.com (Malware_Distribution)"; content:"|0d|google-adsenc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gossiptradetalks.info (Malware_Distribution)"; content:"|10|gossiptradetalks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h102-114.net.lan-rybnitsa.com (Malware_Distribution)"; content:"|08|h102-114|03|net|0c|lan-rybnitsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoperjoper.ru (Malware_Distribution)"; content:"|0a|hoperjoper|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iess70elec.rr.nu (Malware_Distribution)"; content:"|0a|iess70elec|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ift72hbot.rr.nu (Malware_Distribution)"; content:"|09|ift72hbot|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilto27nint.rr.nu (Malware_Distribution)"; content:"|0a|ilto27nint|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infoitpoweringgathering.com (Malware_Distribution)"; content:"|17|infoitpoweringgathering|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infoitpoweringgatheringon.com (Malware_Distribution)"; content:"|19|infoitpoweringgatheringon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inful07commi.rr.nu (Malware_Distribution)"; content:"|0c|inful07commi|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kgrodko.com (Malware_Distribution)"; content:"|07|kgrodko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khcol.com (Malware_Distribution)"; content:"|05|khcol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kupilkoprodv.in (Malware_Infectors)"; content:"|0c|kupilkoprodv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastednorwich.com (Malware_Distribution)"; content:"|0d|lastednorwich|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lilypophilypop.com (Malware_Distribution)"; content:"|0e|lilypophilypop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llowe31dmeth.rr.nu (Malware_Distribution)"; content:"|0c|llowe31dmeth|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mertsssooopa.in (Malware_Infectors)"; content:"|0c|mertsssooopa|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mykonfupda.in (Malware_Infectors)"; content:"|0a|mykonfupda|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naturmedsrl.it (Zeus_Zbot_SpyEye)"; content:"|0b|naturmedsrl|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nlhotelsguide.net (Malware_Infectors)"; content:"|0d|nlhotelsguide|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nltorrentsguide.biz (Malware_Infectors)"; content:"|0f|nltorrentsguide|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nltorrentsguide.co (Malware_Infectors)"; content:"|0f|nltorrentsguide|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nltorrentsguide.com (Malware_Infectors)"; content:"|0f|nltorrentsguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nltorrentsmap.com (Malware_Infectors)"; content:"|0d|nltorrentsmap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nltorrentsmap.org (Malware_Infectors)"; content:"|0d|nltorrentsmap|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nzkfvilisiciliana.info (Malware_Infectors)"; content:"|11|nzkfvilisiciliana|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paroleshefnwmb.info (Malware_Infectors)"; content:"|0e|paroleshefnwmb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poorpore.in (Malware_Infectors)"; content:"|08|poorpore|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qfoccfsiciliana.info (Malware_Infectors)"; content:"|0f|qfoccfsiciliana|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwoei733yrhv.com (Malware_Infectors)"; content:"|0c|qwoei733yrhv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup resellingblackbranch.com (Malware_Infectors)"; content:"|14|resellingblackbranch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safecleanerki.rr.nu (Malware_Distribution)"; content:"|0d|safecleanerki|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sekurepays.org (Malware_Distribution)"; content:"|0a|sekurepays|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sical59lymemo.rr.nu (Malware_Distribution)"; content:"|0d|sical59lymemo|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sicilianaxulnhuhm.info (Malware_Infectors)"; content:"|11|sicilianaxulnhuhm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sokoloperkovuske.com (Malware_Distribution)"; content:"|10|sokoloperkovuske|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sokoloperkovuskedi.com (Malware_Distribution)"; content:"|12|sokoloperkovuskedi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soneo.biz (Malware_Distribution)"; content:"|05|soneo|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spo334vg6.com (Malware_Infectors)"; content:"|09|spo334vg6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stockinfobroadcasttwo.com (Malware_Infectors)"; content:"|15|stockinfobroadcasttwo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuqwodbv4.biz (Malware_Infectors)"; content:"|0a|stuqwodbv4|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teleskolkino.com (Malware_Infectors)"; content:"|0c|teleskolkino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topline4u.info (Malware_Infectors)"; content:"|09|topline4u|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tw6bdf5zy.guardeddenies.com (Malware_Infectors)"; content:"|09|tw6bdf5zy|0d|guardeddenies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyco93uplin.rr.nu (Malware_Distribution)"; content:"|0b|tyco93uplin|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvvsk-mir.in (Malware_Distribution)"; content:"|09|vvvsk-mir|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wbesnancer.org (Malware_Distribution)"; content:"|0a|wbesnancer|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup welcometotheglobalisorg.com (Malware_Distribution)"; content:"|17|welcometotheglobalisorg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wildboy.ru (Zeus_Zbot_SpyEye)"; content:"|07|wildboy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winbatch-matlab.ru (Malware_Infectors)"; content:"|0f|winbatch-matlab|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winedvfallw.info (Malware_Infectors)"; content:"|0b|winedvfallw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wuiwe74hvgsd.com (Malware_Infectors)"; content:"|0c|wuiwe74hvgsd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yuwe4f5g645g.com (Malware_Infectors)"; content:"|0c|yuwe4f5g645g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zevkblog.ru (Malware_Distribution)"; content:"|08|zevkblog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cz88.net (Malware_Infectors)"; content:"|04|cz88|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adware-2009.com (Malware_Infectors)"; content:"|0b|adware-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 198qb.com ()"; content:"|05|198qb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1change-your-life.com ()"; content:"|11|1change-your-life|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1efmdfieha-mff.com (Botnet_C&C)"; content:"|0e|1efmdfieha-mff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1o4ynbreuk.com (Botnet_C&C)"; content:"|0a|1o4ynbreuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1sweet-success.com ()"; content:"|0e|1sweet-success|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adware-2011.com (Malware_Infectors)"; content:"|0b|adware-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amalitarochell.com ()"; content:"|0e|amalitarochell|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amberschool.com ()"; content:"|0b|amberschool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amcovtayvtell.com ()"; content:"|0d|amcovtayvtell|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ameliayolanda.com ()"; content:"|0d|ameliayolanda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amelinekyrstin.com ()"; content:"|0e|amelinekyrstin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americanultrade.com (Malware_Distribution)"; content:"|0f|americanultrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americtradeulti.com (Malware_Distribution)"; content:"|0f|americtradeulti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americultimtrade.com (Malware_Distribution)"; content:"|10|americultimtrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anarhiyanahhh.com ()"; content:"|0d|anarhiyanahhh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ancberclastop.com ()"; content:"|0d|ancberclastop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ancvardallvoica.com ()"; content:"|0f|ancvardallvoica|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup andcudland.com ()"; content:"|0a|andcudland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anewsupdate.net ()"; content:"|0b|anewsupdate|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anexalteacglene.com ()"; content:"|0f|anexalteacglene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awardspacing.ru (Malware_Distribution)"; content:"|0c|awardspacing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boqupyvuru.com (Spyware)"; content:"|0a|boqupyvuru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup calid.org (Malware_Distribution)"; content:"|05|calid|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citadelhk.com (Phishing_and_Theft)"; content:"|09|citadelhk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cixizacakudyko.com (Spyware)"; content:"|0e|cixizacakudyko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cluuocw.ce.ms (Malware_Distribution)"; content:"|07|cluuocw|02|ce|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cretlotusyog.osa.pl (Malware_Distribution)"; content:"|0c|cretlotusyog|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup davizyzaky.com (Spyware)"; content:"|0a|davizyzaky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dihojocitiz.com (Spyware)"; content:"|0b|dihojocitiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynatary.com (Fake_AV)"; content:"|08|dynatary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ejuvenatia.monbe.be (Malware_Distribution)"; content:"|0a|ejuvenatia|05|monbe|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emb.imbark.org (Phishing_and_Theft)"; content:"|03|emb|06|imbark|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fidgeter.info (Malware_Distribution)"; content:"|08|fidgeter|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fkltz.com (Phishing_and_Theft)"; content:"|05|fkltz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeautogame.tk (Malware_Distribution)"; content:"|0c|freeautogame|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gavywelugamoqe.com (Spyware)"; content:"|0e|gavywelugamoqe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gfjnfghsfshsf.osa.pl (Malware_Distribution)"; content:"|0d|gfjnfghsfshsf|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsm-sattelite.ru (Malware_Distribution)"; content:"|0d|gsm-sattelite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardened.info (Malware_Distribution)"; content:"|08|hardened|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardhack.info (Malware_Distribution)"; content:"|08|hardhack|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellap2000.cc (Malware_Distribution)"; content:"|0a|hellap2000|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heretrix.co.cc (Malware_Distribution)"; content:"|08|heretrix|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horiqomep.com (Spyware)"; content:"|09|horiqomep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htpcapital.com (Malware_Distribution)"; content:"|0a|htpcapital|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hungaria-agarklub.fw.hu (Malware_Distribution)"; content:"|11|hungaria-agarklub|02|fw|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indexler.freehostia.com (Malware_Distribution)"; content:"|08|indexler|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jadmal.com (Spyware)"; content:"|06|jadmal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jbait.name (Malware_Distribution)"; content:"|05|jbait|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kigutohigazem.com (Spyware)"; content:"|0d|kigutohigazem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup licensecabe.com (Fake_AV)"; content:"|0b|licensecabe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lohyfyrasokiso.com (Spyware)"; content:"|0e|lohyfyrasokiso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loj7g.cz.cc (Malware_Distribution)"; content:"|05|loj7g|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lozebymova.com (Spyware)"; content:"|0a|lozebymova|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mastermobel.orgfree.com (Malware_Distribution)"; content:"|0b|mastermobel|07|orgfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miferyciq.com (Spyware)"; content:"|09|miferyciq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mijywujysa.com (Spyware)"; content:"|0a|mijywujysa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mimopywyn.com (Spyware)"; content:"|09|mimopywyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobesinolacuke.com (Spyware)"; content:"|0e|mobesinolacuke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muxyrygitobuhik.info (Malware_Infectors)"; content:"|0f|muxyrygitobuhik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muzico.ru (Malware_Distribution)"; content:"|06|muzico|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup network-teaser.ru (Malware_Distribution)"; content:"|0e|network-teaser|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niklejo.net (Malware_Distribution)"; content:"|07|niklejo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nynigywuheqe.com (Spyware)"; content:"|0c|nynigywuheqe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup om2modfitness.osa.pl (Malware_Distribution)"; content:"|0d|om2modfitness|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pearking.co.cc (Malware_Distribution)"; content:"|08|pearking|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinoguzeseme.com (Spyware)"; content:"|0c|pinoguzeseme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntubeu.com (Malware_Distribution)"; content:"|09|porntubeu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup posubudiqof.com (Spyware)"; content:"|0b|posubudiqof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profile-checker.co.uk (Malware_Distribution)"; content:"|0f|profile-checker|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qindars.co.cc (Malware_Distribution)"; content:"|07|qindars|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qobirawif.com (Spyware)"; content:"|09|qobirawif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualmy.co.cc (Malware_Distribution)"; content:"|06|qualmy|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qulygimokine.com (Spyware)"; content:"|0c|qulygimokine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rinysegaci.com (Spyware)"; content:"|0a|rinysegaci|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalbuka.com ()"; content:"|09|royalbuka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rqystb4b6cc.biz (Malware_Infectors)"; content:"|0b|rqystb4b6cc|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrcch.com ()"; content:"|05|rrcch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrrrrreport.com (Fake_AV)"; content:"|0b|rrrrrreport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruebari.com ()"; content:"|07|ruebari|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rukiso.com ()"; content:"|06|rukiso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rulebroukdtstavd.com ()"; content:"|10|rulebroukdtstavd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secmindnet.com ()"; content:"|0a|secmindnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secondreporters.com (Fake_AV)"; content:"|0f|secondreporters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-dominator.com ()"; content:"|10|secure-dominator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sesusihyt.com (Spyware)"; content:"|09|sesusihyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sorenara.net (Zeus_Zbot_SpyEye)"; content:"|08|sorenara|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacingcell.ru (Malware_Distribution)"; content:"|0b|spacingcell|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdssopka.tk (Malware_Distribution)"; content:"|08|tdssopka|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdstraff.net (Malware_Distribution)"; content:"|08|tdstraff|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teguwumefu.com (Spyware)"; content:"|0a|teguwumefu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustebuyshop.com (Zeus_Zbot_SpyEye)"; content:"|0d|trustebuyshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tucaxiqiwityp.com (Spyware)"; content:"|0d|tucaxiqiwityp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unallied.co.cc (Malware_Distribution)"; content:"|08|unallied|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unamazed.co.cc (Malware_Distribution)"; content:"|08|unamazed|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unamused.co.cc (Malware_Distribution)"; content:"|08|unamused|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vowoputaru.com (Spyware)"; content:"|0a|vowoputaru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vyganison.com (Spyware)"; content:"|09|vyganison|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wescor.biz (Botnet_C&C)"; content:"|06|wescor|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wihasiwaji.com (Spyware)"; content:"|0a|wihasiwaji|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winning.co.cc (Malware_Distribution)"; content:"|07|winning|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xybobimaholos.com (Spyware)"; content:"|0d|xybobimaholos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ylanynaion.com (Fake_AV)"; content:"|0a|ylanynaion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yuruo.net (Malware_Distribution)"; content:"|05|yuruo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziomale.net63.net (Malware_Distribution)"; content:"|07|ziomale|05|net63|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zujytuhehok.com (Spyware)"; content:"|0b|zujytuhehok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myteenmovies.net (Malware_Infectors)"; content:"|0c|myteenmovies|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 100myr.com (Zeus_Zbot_SpyEye)"; content:"|06|100myr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1j21.com (Malware_Infectors)"; content:"|04|1j21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaagsj33rv5.biz (Malware_Infectors)"; content:"|0b|aaagsj33rv5|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adx4bf5.com (Zeus_Zbot_SpyEye)"; content:"|07|adx4bf5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appscoast.com (Zeus_Zbot_SpyEye)"; content:"|09|appscoast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arminboutique.com (Zeus_Zbot_SpyEye)"; content:"|0d|arminboutique|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best.amberfreda.com (Malware_Infectors)"; content:"|04|best|0a|amberfreda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brotherjesse.com (Zeus_Zbot_SpyEye)"; content:"|0c|brotherjesse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buritoluck.com (Malware_Infectors)"; content:"|0a|buritoluck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clanquack.ru (Zeus_Zbot_SpyEye)"; content:"|09|clanquack|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fwbjgras.cz.cc (Malware_Distribution)"; content:"|08|fwbjgras|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jdueyd.co.cc (Malware_Infectors)"; content:"|06|jdueyd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jupaizeuph.ru (Zeus_Zbot_SpyEye)"; content:"|0a|jupaizeuph|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laketulip.ru (Zeus_Zbot_SpyEye)"; content:"|09|laketulip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latestglad.com (Malware_Infectors)"; content:"|0a|latestglad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovesite.ro (Malware_Distribution)"; content:"|08|lovesite|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mothersandmoretritown.org (Malware_Infectors)"; content:"|15|mothersandmoretritown|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-virus-scanner.com (Fake_AV)"; content:"|14|online-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pe30.glx.nl (Malware_Infectors)"; content:"|04|pe30|03|glx|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinalbal.com (Malware_Distribution)"; content:"|08|pinalbal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plantlunch.ru (Zeus_Zbot_SpyEye)"; content:"|0a|plantlunch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pop3.bbzassociates.com (Malware_Infectors)"; content:"|04|pop3|0d|bbzassociates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rehandntersfee.ru (Zeus_Zbot_SpyEye)"; content:"|0e|rehandntersfee|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scuolaedileal.it (Malware_Infectors)"; content:"|0d|scuolaedileal|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seawoljoystick.ru (Zeus_Zbot_SpyEye)"; content:"|0e|seawoljoystick|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servesonjany.com ()"; content:"|0c|servesonjany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setbedow.com ()"; content:"|08|setbedow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setrakimaki.com ()"; content:"|0b|setrakimaki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seumdoctor.net ()"; content:"|0a|seumdoctor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup severolhourwoet.com ()"; content:"|0f|severolhourwoet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexdovncgeck.com ()"; content:"|0c|sexdovncgeck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spectivearspectivear.osa.pl (Malware_Infectors)"; content:"|14|spectivearspectivear|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sr-starbladecrow.com ()"; content:"|10|sr-starbladecrow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssl.aukro.ua (Zeus_Zbot_SpyEye)"; content:"|03|ssl|05|aukro|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stamset.com (Malware_Distribution)"; content:"|07|stamset|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starbladecr0w.com ()"; content:"|0d|starbladecr0w|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starbladecrow.com ()"; content:"|0d|starbladecrow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starbladecrow2.com ()"; content:"|0e|starbladecrow2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starbladecrow3.com ()"; content:"|0e|starbladecrow3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starbladecrow4.com ()"; content:"|0e|starbladecrow4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stardcowerwater.com ()"; content:"|0f|stardcowerwater|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statikru.com ()"; content:"|08|statikru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uritoluck.com (Malware_Infectors)"; content:"|09|uritoluck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verioso.com ()"; content:"|07|verioso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veter-ok.com ()"; content:"|08|veter-ok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgalsexcoxe.com ()"; content:"|0b|vgalsexcoxe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgdz.net ()"; content:"|04|vgdz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgeteplanfat.com ()"; content:"|0c|vgeteplanfat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgyvestxade.com ()"; content:"|0b|vgyvestxade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vhadreachmusoc.com ()"; content:"|0e|vhadreachmusoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vhereplacejame.com ()"; content:"|0e|vhereplacejame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vholevucemay.com ()"; content:"|0c|vholevucemay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viperheart.ru (Zeus_Zbot_SpyEye)"; content:"|0a|viperheart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virginialeda.com ()"; content:"|0c|virginialeda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webplayerddl.com (Malware_Distribution)"; content:"|0c|webplayerddl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsdhealthy.com (Malware_Infectors)"; content:"|0a|wsdhealthy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xapxoreplace.com ()"; content:"|0c|xapxoreplace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xkyxz0cdohxz6u.com (Botnet_C&C)"; content:"|0e|xkyxz0cdohxz6u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaebalinax.com (Botnet_C&C)"; content:"|0a|zaebalinax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1ns4n3.de (Zeus_Zbot_SpyEye)"; content:"|06|1ns4n3|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3drugs.com ()"; content:"|06|3drugs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6ag1jauqlii.com (Botnet_C&C)"; content:"|0b|6ag1jauqlii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acheterthomasabo.com ()"; content:"|10|acheterthomasabo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acrobat-online.com ()"; content:"|0e|acrobat-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acrobat-web.com ()"; content:"|0b|acrobat-web|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actualizacionbancaria.com ()"; content:"|15|actualizacionbancaria|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addsecovdtook.com ()"; content:"|0d|addsecovdtook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addsuchmenmy.com ()"; content:"|0c|addsuchmenmy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adeleenid.com ()"; content:"|09|adeleenid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adelheiddale.com ()"; content:"|0c|adelheiddale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aderdoctor.net ()"; content:"|0a|aderdoctor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aernloail.com ()"; content:"|09|aernloail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afteryearbaj.com ()"; content:"|0c|afteryearbaj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aganundraddark.com ()"; content:"|0e|aganundraddark|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agaunwatirfiw.com ()"; content:"|0d|agaunwatirfiw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agedstuff.ru (Malware_Distribution)"; content:"|09|agedstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aggucjvery.com ()"; content:"|0a|aggucjvery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agitpavilbigan.com ()"; content:"|0e|agitpavilbigan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agizu.net ()"; content:"|05|agizu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agogriatlust.com ()"; content:"|0c|agogriatlust|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup answerfloat.ru ()"; content:"|0b|answerfloat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awendever.com ()"; content:"|09|awendever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awesomepornofree.com ()"; content:"|10|awesomepornofree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ayrbotdmusyc.com ()"; content:"|0c|ayrbotdmusyc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aztzommonbut.com ()"; content:"|0c|aztzommonbut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baafouhdpose.com ()"; content:"|0c|baafouhdpose|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bacdecededeffer.com ()"; content:"|0f|bacdecededeffer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besrom.com (Spyware)"; content:"|06|besrom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brightory.com ()"; content:"|09|brightory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byid-element.ru ()"; content:"|0c|byid-element|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casualroute.com ()"; content:"|0b|casualroute|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clazmiznod.com ()"; content:"|0a|clazmiznod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-fresh-teeth.com ()"; content:"|11|clean-fresh-teeth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearbuyldnever.com ()"; content:"|0f|clearbuyldnever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deadpage.ru (Malware_Distribution)"; content:"|08|deadpage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynaery.com (Spyware)"; content:"|07|dynaery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emptyspa.ru (Malware_Distribution)"; content:"|08|emptyspa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiftypercentworker.com (Malware_Distribution)"; content:"|12|fiftypercentworker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filebale.ru (SEO_Fraud)"; content:"|08|filebale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup float-answer.ru ()"; content:"|0c|float-answer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flydoronolub.com ()"; content:"|0c|flydoronolub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuehlediebezahlung.com (Malware_Distribution)"; content:"|12|fuehlediebezahlung|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuehlediecon.com (Malware_Distribution)"; content:"|0c|fuehlediecon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gibropony.com ()"; content:"|09|gibropony|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gidenvap.com (Malware_Distribution)"; content:"|08|gidenvap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gilemedic.net ()"; content:"|09|gilemedic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haltermancelo.ru (SEO_Fraud)"; content:"|0d|haltermancelo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heemitchea.net (Spyware)"; content:"|0a|heemitchea|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helexxaione.com (Malware_Distribution)"; content:"|0b|helexxaione|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdampffoto.nl (Spyware)"; content:"|0c|holdampffoto|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotlinking.ru ()"; content:"|0a|hotlinking|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huntersamplifi.ru (SEO_Fraud)"; content:"|0e|huntersamplifi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hypulycyfaqaba.com (Spyware)"; content:"|0e|hypulycyfaqaba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivestgrpp.ru (Botnet_C&C)"; content:"|09|ivestgrpp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justingyellow.ru ()"; content:"|0d|justingyellow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knallrattern.com (Malware_Distribution)"; content:"|0c|knallrattern|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kuemmeljoe.com (Malware_Distribution)"; content:"|0a|kuemmeljoe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labrador2011.ru (Spyware)"; content:"|0c|labrador2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litfox.ru (Malware_Distribution)"; content:"|06|litfox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manhua5.com (Malware_Distribution)"; content:"|07|manhua5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megahock.ru (Malware_Distribution)"; content:"|08|megahock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miniokoyokolia.su (SEO_Fraud)"; content:"|0e|miniokoyokolia|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mlxvacanthomes.net (Malware_Distribution)"; content:"|0e|mlxvacanthomes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmoframe.com ()"; content:"|08|mmoframe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mongoneger.com (Malware_Distribution)"; content:"|0a|mongoneger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mortgagebrokers.tv (Spyware)"; content:"|0f|mortgagebrokers|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muellgeburten.com (Malware_Distribution)"; content:"|0d|muellgeburten|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njorkus.com ()"; content:"|07|njorkus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panyulvxingshe.com (Malware_Distribution)"; content:"|0e|panyulvxingshe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piecerack.ru (Malware_Distribution)"; content:"|09|piecerack|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjehedsafe.com ()"; content:"|0a|pjehedsafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porno-geier.com (Malware_Distribution)"; content:"|0b|porno-geier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prohibitedhotlinking.ru ()"; content:"|14|prohibitedhotlinking|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pubepujiwusiwy.com (Spyware)"; content:"|0e|pubepujiwusiwy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup queenchair.ru (SEO_Fraud)"; content:"|0a|queenchair|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rehudomydefe.com (Spyware)"; content:"|0c|rehudomydefe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rubugrave.com (Spyware)"; content:"|09|rubugrave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sesycifaqago.com (Spyware)"; content:"|0c|sesycifaqago|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shortcuticon.ru ()"; content:"|0c|shortcuticon|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup splitflash.ru (Malware_Distribution)"; content:"|0a|splitflash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stervyatniks.ru (Zeus_Zbot_SpyEye)"; content:"|0c|stervyatniks|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stormhock.ru (Malware_Distribution)"; content:"|09|stormhock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strategytorrent.com (Spyware)"; content:"|0f|strategytorrent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thesutmori.com (Spyware)"; content:"|0a|thesutmori|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tocnjublac.com (Spyware)"; content:"|0a|tocnjublac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uglyas.com (Malware_Distribution)"; content:"|06|uglyas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vequtycarykeg.com (Spyware)"; content:"|0d|vequtycarykeg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watersod.ru (Malware_Distribution)"; content:"|08|watersod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yummyship.ru (Malware_Distribution)"; content:"|09|yummyship|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zetofyhecynovu.com (Spyware)"; content:"|0e|zetofyhecynovu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup absqvhpldvsmclt.com ()"; content:"|0f|absqvhpldvsmclt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adhcssvuayv.com ()"; content:"|0b|adhcssvuayv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agpdvawvr.com ()"; content:"|09|agpdvawvr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aguhlabfubbvek.com ()"; content:"|0e|aguhlabfubbvek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup algvgcawwdsmiksvol.com ()"; content:"|12|algvgcawwdsmiksvol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amobragjgge.com ()"; content:"|0b|amobragjgge|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anqsjvhjjkypabm.com ()"; content:"|0f|anqsjvhjjkypabm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anxpepxpukbfmh.com ()"; content:"|0e|anxpepxpukbfmh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aredirect.ru (Malware_Distribution)"; content:"|09|aredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659044; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arhpgoeeasi.com ()"; content:"|0b|arhpgoeeasi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arqogipjsbcdmk.com ()"; content:"|0e|arqogipjsbcdmk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atfkpyicxsrrwqbct.com ()"; content:"|11|atfkpyicxsrrwqbct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atredret.ru (Malware_Distribution)"; content:"|08|atredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atuealmjufcwwb.com ()"; content:"|0e|atuealmjufcwwb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awckeliqcherasntmin.com ()"; content:"|13|awckeliqcherasntmin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baxqqapjrxxetjelhtk.com ()"; content:"|13|baxqqapjrxxetjelhtk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbmfswfgmljwj.com ()"; content:"|0d|bbmfswfgmljwj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bklerdwiadlxxbjunwu.com ()"; content:"|13|bklerdwiadlxxbjunwu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bpredret.ru (Malware_Distribution)"; content:"|08|bpredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bredirect.ru (Malware_Distribution)"; content:"|09|bredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caredret.ru (Malware_Distribution)"; content:"|08|caredret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup credirect.ru (Malware_Distribution)"; content:"|09|credirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cswtnpnuhixdwjgm.com ()"; content:"|10|cswtnpnuhixdwjgm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxmdhrpwuvyl.com ()"; content:"|0c|cxmdhrpwuvyl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dcyakhpr.com ()"; content:"|08|dcyakhpr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup degbxpos.com ()"; content:"|08|degbxpos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfyxptqjxwtdkjjbiu.com ()"; content:"|12|dfyxptqjxwtdkjjbiu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgrdrqkpmggukqo.com ()"; content:"|0f|dgrdrqkpmggukqo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djeuagtquwwhera.com ()"; content:"|0f|djeuagtquwwhera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlsvfpmniphnmxnvoeo.com ()"; content:"|13|dlsvfpmniphnmxnvoeo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnmjahdaigeydiiorky.com ()"; content:"|13|dnmjahdaigeydiiorky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dpdadshi.com ()"; content:"|08|dpdadshi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dpjbclufd.com ()"; content:"|09|dpjbclufd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dpyeoipbso.com ()"; content:"|0a|dpyeoipbso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dredirect.ru (Malware_Distribution)"; content:"|09|dredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drpfrkvdttdkhgpqi.com ()"; content:"|11|drpfrkvdttdkhgpqi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dthcjcsdxywxlsng.com ()"; content:"|10|dthcjcsdxywxlsng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvgeqsama.com ()"; content:"|09|dvgeqsama|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dxovrcmyletmggxf.com ()"; content:"|10|dxovrcmyletmggxf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dykxkasesippbsjb.com ()"; content:"|10|dykxkasesippbsjb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dypislng.com ()"; content:"|08|dypislng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eaayjpeyabqf.com ()"; content:"|0c|eaayjpeyabqf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebddteinurkortapgs.com ()"; content:"|12|ebddteinurkortapgs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecmdkxukhtf.com ()"; content:"|0b|ecmdkxukhtf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edqmjbyjcxyjqnjjodh.com ()"; content:"|13|edqmjbyjcxyjqnjjodh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeuprbpohspwje.com ()"; content:"|0e|eeuprbpohspwje|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eredirect.ru (Malware_Distribution)"; content:"|09|eredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fqaeucdaicvnisqbd.com ()"; content:"|11|fqaeucdaicvnisqbd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fredirect.ru (Malware_Distribution)"; content:"|09|fredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fsksblipt.com ()"; content:"|09|fsksblipt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fssuatmti.com ()"; content:"|09|fssuatmti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fujosogkpsxthf.com ()"; content:"|0e|fujosogkpsxthf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fvfeiutlwaw.com ()"; content:"|0b|fvfeiutlwaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fxkapveygtffbkv.com ()"; content:"|0f|fxkapveygtffbkv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fybdqchsheqiul.com ()"; content:"|0e|fybdqchsheqiul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gccadwuf.com ()"; content:"|08|gccadwuf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geyameywwoaf.com ()"; content:"|0c|geyameywwoaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ggpmcodfppkjirg.com ()"; content:"|0f|ggpmcodfppkjirg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghxctletck.com ()"; content:"|0a|ghxctletck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ginbkjuweobmwp.com ()"; content:"|0e|ginbkjuweobmwp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gjehgcrav.com ()"; content:"|09|gjehgcrav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gjvhfiouvwiqvtewbu.com ()"; content:"|12|gjvhfiouvwiqvtewbu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gkholyjchymn.com ()"; content:"|0c|gkholyjchymn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gkusimsgjcauehgdjn.com ()"; content:"|12|gkusimsgjcauehgdjn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gmeuasnn.com ()"; content:"|08|gmeuasnn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goopndlgvy.com ()"; content:"|0a|goopndlgvy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gormlunjjt.com ()"; content:"|0a|gormlunjjt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gqmrhecnntccmawclmq.com ()"; content:"|13|gqmrhecnntccmawclmq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gredirect.ru (Malware_Distribution)"; content:"|09|gredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsbwxfecgbmuysm.com ()"; content:"|0f|gsbwxfecgbmuysm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwbdgrlikclhthyivym.com ()"; content:"|13|gwbdgrlikclhthyivym|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haqkwkokaigcdslnrlr.com ()"; content:"|13|haqkwkokaigcdslnrlr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hbwpvcnwwcdgfojuixm.com ()"; content:"|13|hbwpvcnwwcdgfojuixm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hetjymgiddyamqq.com ()"; content:"|0f|hetjymgiddyamqq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hfegocufjkndwc.com ()"; content:"|0e|hfegocufjkndwc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgubujdad.com ()"; content:"|09|hgubujdad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhowujyrcvdrwpdvsck.com ()"; content:"|13|hhowujyrcvdrwpdvsck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hijkitpq.com ()"; content:"|08|hijkitpq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjwrnlvdbcmjrfkjx.com ()"; content:"|11|hjwrnlvdbcmjrfkjx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjxrksvo.com ()"; content:"|08|hjxrksvo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hredirect.ru (Malware_Distribution)"; content:"|09|hredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugnnpnymbwnhtuh.com ()"; content:"|10|hugnnpnymbwnhtuh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hxpgffdwbevww.com ()"; content:"|0d|hxpgffdwbevww|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idseneqmupdijjklvtm.com ()"; content:"|13|idseneqmupdijjklvtm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ieugluxmlx.com ()"; content:"|0a|ieugluxmlx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igspslbpjencmfax.com ()"; content:"|10|igspslbpjencmfax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iredirect.ru (Malware_Distribution)"; content:"|09|iredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jredirect.ru (Malware_Distribution)"; content:"|09|jredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kmyxdodog.com ()"; content:"|09|kmyxdodog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knugxvsimayety.com ()"; content:"|0e|knugxvsimayety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kojadineqlbbfvtwlff.com ()"; content:"|13|kojadineqlbbfvtwlff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kpkyaxyytagbk.com ()"; content:"|0d|kpkyaxyytagbk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kqrkegigdtjxxcrvl.com ()"; content:"|11|kqrkegigdtjxxcrvl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kqweenxsiyjtbe.com ()"; content:"|0e|kqweenxsiyjtbe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kredirect.ru (Malware_Distribution)"; content:"|09|kredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krtvnyxc.com ()"; content:"|08|krtvnyxc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ktdofbmltjyt.com ()"; content:"|0c|ktdofbmltjyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kvoxyhnaggyqrcc.com ()"; content:"|0f|kvoxyhnaggyqrcc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laiotlboxklvpcdfhu.com ()"; content:"|12|laiotlboxklvpcdfhu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lanwiojchmenjhn.com ()"; content:"|0f|lanwiojchmenjhn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup larpjpbblpnkdwyx.com ()"; content:"|10|larpjpbblpnkdwyx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lbcqwwxucahiulchx.com ()"; content:"|11|lbcqwwxucahiulchx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lbdlmcmfuinc.com ()"; content:"|0c|lbdlmcmfuinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lcloroifjeilomowq.com ()"; content:"|11|lcloroifjeilomowq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ldanknmdiqtrot.com ()"; content:"|0e|ldanknmdiqtrot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leqnxekmi.com ()"; content:"|09|leqnxekmi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lfnjosunfd.com ()"; content:"|0a|lfnjosunfd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lgeohbboqpngfap.com ()"; content:"|0f|lgeohbboqpngfap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lredirect.ru (Malware_Distribution)"; content:"|09|lredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mredirect.ru (Malware_Distribution)"; content:"|09|mredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njqvexdhwhutar.com ()"; content:"|0e|njqvexdhwhutar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noslwqaagtoxunnv.com ()"; content:"|10|noslwqaagtoxunnv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nqlocokxsjnsffxeu.com ()"; content:"|11|nqlocokxsjnsffxeu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nrcmbkxssydac.com ()"; content:"|0d|nrcmbkxssydac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nredirect.ru (Malware_Distribution)"; content:"|09|nredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntnwcxtwgxwecrdxr.com ()"; content:"|11|ntnwcxtwgxwecrdxr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntohnxgjijsgi.com ()"; content:"|0d|ntohnxgjijsgi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntqbbnywghbjvsoivo.com ()"; content:"|12|ntqbbnywghbjvsoivo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nwetlnpjovgxmj.com ()"; content:"|0e|nwetlnpjovgxmj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nwoyejym.com ()"; content:"|08|nwoyejym|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nwrqebry.com ()"; content:"|08|nwrqebry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyxmwnkkacwamvj.com ()"; content:"|0f|nyxmwnkkacwamvj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyyhahsslkflyhulcgl.com ()"; content:"|13|nyyhahsslkflyhulcgl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oaifpapl.com ()"; content:"|08|oaifpapl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obcjfjseku.com ()"; content:"|0a|obcjfjseku|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obmfvijftylgjpf.com ()"; content:"|0f|obmfvijftylgjpf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ocnsfoyrdplmewnyx.com ()"; content:"|11|ocnsfoyrdplmewnyx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogpshvhk.com ()"; content:"|08|ogpshvhk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohpmyviumie.com ()"; content:"|0b|ohpmyviumie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oiexgmycrtwirsgcmv.com ()"; content:"|12|oiexgmycrtwirsgcmv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ojmitlcyjsuyb.com ()"; content:"|0d|ojmitlcyjsuyb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ojvpkaohbddmbfac.com ()"; content:"|10|ojvpkaohbddmbfac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oluddrbaeb.com ()"; content:"|0a|oluddrbaeb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omsilsdcpdsgpxm.com ()"; content:"|0f|omsilsdcpdsgpxm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opxxjqvyjllj.com ()"; content:"|0c|opxxjqvyjllj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oqayununxmqdxo.com ()"; content:"|0e|oqayununxmqdxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oqenuuygfpvopu.com ()"; content:"|0e|oqenuuygfpvopu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oredirect.ru (Malware_Distribution)"; content:"|09|oredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orgflqxdnoyecgwib.com ()"; content:"|11|orgflqxdnoyecgwib|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oukicfldnvxhrtxvuqr.com ()"; content:"|13|oukicfldnvxhrtxvuqr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ouwwtmcnuiudw.com ()"; content:"|0d|ouwwtmcnuiudw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ovgucbrrvxqufkwq.com ()"; content:"|10|ovgucbrrvxqufkwq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup predirect.ru (Malware_Distribution)"; content:"|09|predirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qpvvabbaqcn.com ()"; content:"|0b|qpvvabbaqcn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqsvttcnvsigkh.com ()"; content:"|0e|qqsvttcnvsigkh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qredirect.ru (Malware_Distribution)"; content:"|09|qredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qsrywodlwhorwibvy.com ()"; content:"|11|qsrywodlwhorwibvy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qukccxcwi.com ()"; content:"|09|qukccxcwi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qvddnchpjtskjmgdlx.com ()"; content:"|12|qvddnchpjtskjmgdlx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwfxemkbuee.com ()"; content:"|0b|qwfxemkbuee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qxdfhujechixcrgdb.com ()"; content:"|11|qxdfhujechixcrgdb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rapbmprhwwm.com ()"; content:"|0b|rapbmprhwwm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rcnnhkcagerrquby.com ()"; content:"|10|rcnnhkcagerrquby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relmyplngdrdxpyv.com ()"; content:"|10|relmyplngdrdxpyv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rfngjynkypsphqfmkh.com ()"; content:"|12|rfngjynkypsphqfmkh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rgcdictp.com ()"; content:"|08|rgcdictp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rglaabsktspwrw.com ()"; content:"|0e|rglaabsktspwrw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rhfdjaecmygcrdgep.com ()"; content:"|11|rhfdjaecmygcrdgep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rhoaahddyhbg.com ()"; content:"|0c|rhoaahddyhbg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjordulltl.com ()"; content:"|0a|rjordulltl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjykgymugqlscttx.com ()"; content:"|10|rjykgymugqlscttx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rkevnmhekdgvnf.com ()"; content:"|0e|rkevnmhekdgvnf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rkxukunrgvpkgmc.com ()"; content:"|0f|rkxukunrgvpkgmc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rlvwjjhntfooonvhlou.com ()"; content:"|13|rlvwjjhntfooonvhlou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rmuyrkxxtk.com ()"; content:"|0a|rmuyrkxxtk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rqybdbvyvjuruuxv.com ()"; content:"|10|rqybdbvyvjuruuxv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rredirect.ru (Malware_Distribution)"; content:"|09|rredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rsmhdfgpgw.com ()"; content:"|0a|rsmhdfgpgw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtcocsaitmadupgl.com ()"; content:"|10|rtcocsaitmadupgl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rwjsxxvvkbspdjoedi.com ()"; content:"|12|rwjsxxvvkbspdjoedi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxckgnatt.com ()"; content:"|09|rxckgnatt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxkhdpigbqoeco.com ()"; content:"|0e|rxkhdpigbqoeco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rykgnuncbedueeuevxg.com ()"; content:"|13|rykgnuncbedueeuevxg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secdfbpyopjhyhuw.com ()"; content:"|10|secdfbpyopjhyhuw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexdsgnrojhpptqb.com ()"; content:"|10|sexdsgnrojhpptqb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sgimiytkanu.com ()"; content:"|0b|sgimiytkanu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sgjwptrfosjeico.com ()"; content:"|0f|sgjwptrfosjeico|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjfrarsvyhlr.com ()"; content:"|0c|sjfrarsvyhlr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skqbirmcomtjty.com ()"; content:"|0e|skqbirmcomtjty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skroackqs.com ()"; content:"|09|skroackqs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sliokrvnkjenhwgpjl.com ()"; content:"|12|sliokrvnkjenhwgpjl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slmomdmcjuoaxdip.com ()"; content:"|10|slmomdmcjuoaxdip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snkbcptiqgqmlvw.com ()"; content:"|0f|snkbcptiqgqmlvw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sredirect.ru (Malware_Distribution)"; content:"|09|sredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tredirect.ru (Malware_Distribution)"; content:"|09|tredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup txapbjdlsrtpea.com ()"; content:"|0e|txapbjdlsrtpea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ucwkkgbdxvjexa.com ()"; content:"|0e|ucwkkgbdxvjexa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup udvnniovrov.com ()"; content:"|0b|udvnniovrov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ufxsqnjtryrny.com ()"; content:"|0d|ufxsqnjtryrny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ugwytktvhslgjm.com ()"; content:"|0e|ugwytktvhslgjm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhjwxipj.com ()"; content:"|08|uhjwxipj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhndpadrwbuuchcvn.com ()"; content:"|11|uhndpadrwbuuchcvn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uigwsscasowqdiyp.com ()"; content:"|10|uigwsscasowqdiyp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uilmabdaxqlaxuj.com ()"; content:"|0f|uilmabdaxqlaxuj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uiwbtjfp.com ()"; content:"|08|uiwbtjfp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujypninrop.com ()"; content:"|0a|ujypninrop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukbukpuj.com ()"; content:"|08|ukbukpuj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup umiuqmrmvsuiscitx.com ()"; content:"|11|umiuqmrmvsuiscitx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup umjxwuaaso.com ()"; content:"|0a|umjxwuaaso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup umyratdfvmdrlpm.com ()"; content:"|0f|umyratdfvmdrlpm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urcnkvuuju.com ()"; content:"|0a|urcnkvuuju|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uredirect.ru (Malware_Distribution)"; content:"|09|uredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ushfktptgmspn.com ()"; content:"|0d|ushfktptgmspn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utpsygswnjjw.com ()"; content:"|0c|utpsygswnjjw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utvjcdjcwgqm.com ()"; content:"|0c|utvjcdjcwgqm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utvvpcpmqhbnedb.com ()"; content:"|0f|utvvpcpmqhbnedb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uwsctpihlt.com ()"; content:"|0a|uwsctpihlt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uxlyihgvfnqcrfcf.com ()"; content:"|10|uxlyihgvfnqcrfcf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uxqbewwdunihwscfl.com ()"; content:"|11|uxqbewwdunihwscfl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vfcyyjwcdrjjunrrw.com ()"; content:"|11|vfcyyjwcdrjjunrrw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgfsnrewuxeaoxoh.com ()"; content:"|10|vgfsnrewuxeaoxoh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vjpufudekyotltdnog.com ()"; content:"|12|vjpufudekyotltdnog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vjrjcapuwf.com ()"; content:"|0a|vjrjcapuwf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vlupfbsuppipkrvbsdy.com ()"; content:"|13|vlupfbsuppipkrvbsdy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vmdgwbenh.com ()"; content:"|09|vmdgwbenh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vmhgbribbhm.com ()"; content:"|0b|vmhgbribbhm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659010; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vmurixwrquhb.com ()"; content:"|0c|vmurixwrquhb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659011; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vnskyqlkrdfnnp.com ()"; content:"|0e|vnskyqlkrdfnnp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659012; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vpchdxywmxtxedwgfac.com ()"; content:"|13|vpchdxywmxtxedwgfac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659013; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vredirect.ru (Malware_Distribution)"; content:"|09|vredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvhvidpeog.com ()"; content:"|0a|vvhvidpeog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659014; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vxpxgorqkihafv.com ()"; content:"|0e|vxpxgorqkihafv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659015; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vyibjxjnshtry.com ()"; content:"|0d|vyibjxjnshtry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659016; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watqjvqnf.com ()"; content:"|09|watqjvqnf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659017; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wbjatshumpre.com ()"; content:"|0c|wbjatshumpre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659018; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wdcjfyyfwpx.com ()"; content:"|0b|wdcjfyyfwpx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659019; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wgkyyalemnvhdrai.com ()"; content:"|10|wgkyyalemnvhdrai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659020; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiyqctbhe.com ()"; content:"|09|wiyqctbhe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659021; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wldpcgpkdxhdhvlpjc.com ()"; content:"|12|wldpcgpkdxhdhvlpjc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659022; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wmbnkplxddiaktnkjk.com ()"; content:"|12|wmbnkplxddiaktnkjk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659023; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnlgghgffr.com ()"; content:"|0a|wnlgghgffr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659024; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wnoykspnesqfwbkgi.com ()"; content:"|11|wnoykspnesqfwbkgi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659025; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpaxdlstrs.com ()"; content:"|0a|wpaxdlstrs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659026; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpwaislxxgiskgscy.com ()"; content:"|11|wpwaislxxgiskgscy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659027; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wqfmumga.com ()"; content:"|08|wqfmumga|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659028; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wqnefkerofcmrap.com ()"; content:"|0f|wqnefkerofcmrap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659029; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wredirect.ru (Malware_Distribution)"; content:"|09|wredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrfpmykunwbrscjann.com ()"; content:"|12|wrfpmykunwbrscjann|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659030; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsjapwfphnhriq.com ()"; content:"|0e|wsjapwfphnhriq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659031; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xredirect.ru (Malware_Distribution)"; content:"|09|xredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yecjrsxe.com ()"; content:"|08|yecjrsxe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659032; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yicgycrtyoxaiu.com ()"; content:"|0e|yicgycrtyoxaiu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659033; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ykesfabqxbvmns.com ()"; content:"|0e|ykesfabqxbvmns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659034; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ykkcsanct.com ()"; content:"|09|ykkcsanct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659035; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ylvylxwjpkcdl.com ()"; content:"|0d|ylvylxwjpkcdl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659036; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ymcwineqkj.com ()"; content:"|0a|ymcwineqkj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659037; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ynergdikorjg.com ()"; content:"|0c|ynergdikorjg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659038; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yqvndqgijbpmx.com ()"; content:"|0d|yqvndqgijbpmx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659039; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yredirect.ru (Malware_Distribution)"; content:"|09|yredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yscqbwwljsiwwr.com ()"; content:"|0e|yscqbwwljsiwwr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659040; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yssrqxyljwrioko.com ()"; content:"|0f|yssrqxyljwrioko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659041; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yxhkddrdcpbccoabmuk.com ()"; content:"|13|yxhkddrdcpbccoabmuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659042; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyeyutjgnsfrmswdygl.com ()"; content:"|13|yyeyutjgnsfrmswdygl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659043; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zredirect.ru (Malware_Distribution)"; content:"|09|zredirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviran.com (Fake_AV)"; content:"|09|antiviran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659045; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arschtrompeteshop.com (Malware_Infectors)"; content:"|11|arschtrompeteshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659046; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azpros.com ()"; content:"|06|azpros|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659047; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup box-fresh.ru (Malware_Infectors)"; content:"|09|box-fresh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659048; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coxnamelocal.com (Malware_Infectors)"; content:"|0c|coxnamelocal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659049; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup createnshop.net (Malware_Infectors)"; content:"|0b|createnshop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659050; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyberendbaj.in (Malware_Distribution)"; content:"|0b|cyberendbaj|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659051; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyberevorm.in (Malware_Distribution)"; content:"|0a|cyberevorm|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659052; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d76218b961.com (Malware_Infectors)"; content:"|0a|d76218b961|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659053; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defense-association.com ()"; content:"|13|defense-association|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659054; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dentgr.info (Malware_Infectors)"; content:"|06|dentgr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659055; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsll-tsppls.de.lv (Malware_Infectors)"; content:"|0b|dsll-tsppls|02|de|02|lv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659056; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easyfindjoy.com ()"; content:"|0b|easyfindjoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659057; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elopli.info (Malware_Infectors)"; content:"|06|elopli|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659058; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endbaj.in (Malware_Distribution)"; content:"|06|endbaj|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659059; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endbajcomp.in (Malware_Distribution)"; content:"|0a|endbajcomp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659060; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eurotomo.info (Malware_Infectors)"; content:"|08|eurotomo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659061; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evorm.in (Malware_Distribution)"; content:"|05|evorm|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659062; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evormcorp.in (Malware_Distribution)"; content:"|09|evormcorp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659063; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evormhost.in (Malware_Distribution)"; content:"|09|evormhost|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659064; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup felixs.com (Malware_Infectors)"; content:"|06|felixs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659065; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstholderwa.rr.nu (Spyware)"; content:"|0d|firstholderwa|02|rr|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659066; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup froston3725.organiccrap.com (Malware_Infectors)"; content:"|0b|froston3725|0b|organiccrap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659067; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generationbox.ru (Malware_Infectors)"; content:"|0d|generationbox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659068; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodfeelingauto.com ()"; content:"|0f|goodfeelingauto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659069; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gradient-header.ru (Malware_Infectors)"; content:"|0f|gradient-header|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659070; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenrightway.com ()"; content:"|0d|greenrightway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659071; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herfroundfrou.com ()"; content:"|0d|herfroundfrou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659072; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herminialibbey.com ()"; content:"|0e|herminialibbey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659073; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hermionejuli.com ()"; content:"|0c|hermionejuli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659074; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hestiacarla.com ()"; content:"|0b|hestiacarla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659075; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhoxaeiru1190ddk.com (Fake_AV)"; content:"|10|hhoxaeiru1190ddk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659076; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiapnowmost.com ()"; content:"|0b|hiapnowmost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659077; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hidalue.be (Malware_Infectors)"; content:"|07|hidalue|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659078; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotgreenlight.com ()"; content:"|0d|hotgreenlight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659079; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-security-guard.com (Spyware)"; content:"|17|internet-security-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659080; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intervalhits.in (Malware_Infectors)"; content:"|0c|intervalhits|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659081; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-addressing.com ()"; content:"|0d|ip-addressing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659082; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-blocks.com ()"; content:"|09|ip-blocks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659083; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-calculate.com ()"; content:"|0c|ip-calculate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659084; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-dialup.com ()"; content:"|09|ip-dialup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659085; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-firewall.com ()"; content:"|0b|ip-firewall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659086; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-firmware.com ()"; content:"|0b|ip-firmware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659087; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-hiding.com ()"; content:"|09|ip-hiding|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659088; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-netbus.com ()"; content:"|09|ip-netbus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659089; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-operator.com ()"; content:"|0b|ip-operator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659090; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-range.com ()"; content:"|08|ip-range|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659091; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-request.com ()"; content:"|0a|ip-request|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659092; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-subnetwork.com ()"; content:"|0d|ip-subnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659093; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-subsys.com ()"; content:"|09|ip-subsys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659094; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-sysop.com ()"; content:"|08|ip-sysop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659095; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-tracing.com ()"; content:"|0a|ip-tracing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659096; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip-upload.com ()"; content:"|09|ip-upload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659097; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipadfree4me.com ()"; content:"|0b|ipadfree4me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659098; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipdnsnetwork.com ()"; content:"|0c|ipdnsnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659099; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipdnsservice.com ()"; content:"|0c|ipdnsservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659100; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipdnszone.com ()"; content:"|09|ipdnszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659101; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iprofitmargin.com ()"; content:"|0d|iprofitmargin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659102; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqui2kj3gcssss.com (Malware_Infectors)"; content:"|0e|iqui2kj3gcssss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659103; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ireland-uggsboots.net ()"; content:"|11|ireland-uggsboots|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659104; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iriwiw.com ()"; content:"|06|iriwiw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659105; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isellcc.net ()"; content:"|07|isellcc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659106; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isoaanschyl.com ()"; content:"|0b|isoaanschyl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659107; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leayso.info (Malware_Infectors)"; content:"|06|leayso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659108; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mofdmq.changeip.net (Malware_Infectors)"; content:"|06|mofdmq|08|changeip|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659109; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieshowgirl.com ()"; content:"|0d|movieshowgirl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659110; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nationaladvocator.com ()"; content:"|11|nationaladvocator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659111; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nnesm.com ()"; content:"|05|nnesm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659112; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nnyfjpu35j2tnefd.com (Botnet_C&C)"; content:"|10|nnyfjpu35j2tnefd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659113; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noaknikita.com ()"; content:"|0a|noaknikita|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659114; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nodoctor.net ()"; content:"|08|nodoctor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659115; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nodrugspills.net ()"; content:"|0c|nodrugspills|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659116; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nohegofu.com (Malware_Distribution)"; content:"|08|nohegofu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659117; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noiceanimakae.com ()"; content:"|0d|noiceanimakae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659118; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oicp.net ()"; content:"|04|oicp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onesfocus.com ()"; content:"|09|onesfocus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659119; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineendustriyelmutfak.com (Malware_Infectors)"; content:"|17|onlineendustriyelmutfak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659120; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overskin.ru (Malware_Infectors)"; content:"|08|overskin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659121; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pale.eczellcorporation.us (Malware_Infectors)"; content:"|04|pale|11|eczellcorporation|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659122; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peace.hurry2order.net (Malware_Infectors)"; content:"|05|peace|0b|hurry2order|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659123; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pfacalc2011.com ()"; content:"|0b|pfacalc2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659124; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup play.mapsnshopping.com (Malware_Infectors)"; content:"|04|play|0d|mapsnshopping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659125; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pullespacex-filez.ru (Malware_Infectors)"; content:"|11|pullespacex-filez|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659126; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup racingfax.com ()"; content:"|09|racingfax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659127; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ratzeputzel.com (Malware_Infectors)"; content:"|0b|ratzeputzel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659128; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup region.mahzenklup.com (Malware_Infectors)"; content:"|06|region|0a|mahzenklup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659129; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rusview.net ()"; content:"|07|rusview|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659130; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rzelkkf.ns3.name (Malware_Infectors)"; content:"|07|rzelkkf|03|ns3|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659131; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityearth.net (Spyware)"; content:"|0d|securityearth|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659132; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexnationtalk.com ()"; content:"|0d|sexnationtalk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659133; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shortcut-icon.ru (Malware_Infectors)"; content:"|0d|shortcut-icon|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659134; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skin-nav.ru (Malware_Infectors)"; content:"|08|skin-nav|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659135; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softsecurity.biz (Malware_Infectors)"; content:"|0c|softsecurity|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659136; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solidcursor.ru (Malware_Infectors)"; content:"|0b|solidcursor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659137; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sourceinsightonline.com ()"; content:"|13|sourceinsightonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659138; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sqrlkkdeod.americanunfinished.com (Malware_Infectors)"; content:"|0a|sqrlkkdeod|12|americanunfinished|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659139; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stateshortcut.ru (Malware_Infectors)"; content:"|0d|stateshortcut|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659140; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stressed.neptunesreviews.com (Malware_Infectors)"; content:"|08|stressed|0f|neptunesreviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659141; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strictly-prohibited.ru (Malware_Infectors)"; content:"|13|strictly-prohibited|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659142; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup success.greysonchancesite.info (Malware_Infectors)"; content:"|07|success|11|greysonchancesite|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659143; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tkfm.goombayarabia.com (Malware_Infectors)"; content:"|04|tkfm|0d|goombayarabia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659144; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todaygonever.com ()"; content:"|0c|todaygonever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659145; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tokushukai-me.com (Malware_Distribution)"; content:"|0d|tokushukai-me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659146; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twitterdocs.com ()"; content:"|0b|twitterdocs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659147; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uspolicyguide.com ()"; content:"|0d|uspolicyguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659148; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veteransetting.com (Malware_Infectors)"; content:"|0e|veteransetting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659149; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup welldone21.com ()"; content:"|0a|welldone21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659150; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wilsoncallsenter.com ()"; content:"|10|wilsoncallsenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659151; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wtgiuhlqwubiiiiosqer.nl.ai (Malware_Infectors)"; content:"|14|wtgiuhlqwubiiiiosqer|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659152; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xwjbmmp.dhcp.biz (Malware_Infectors)"; content:"|07|xwjbmmp|04|dhcp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659153; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yk8nh3.ru (Malware_Infectors)"; content:"|06|yk8nh3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659154; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 51juben.com.cn (Malware_Distribution)"; content:"|07|51juben|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659155; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 568518.cn (Malware_Distribution)"; content:"|06|568518|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659156; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alive-finder.com (Malware_Distribution)"; content:"|0c|alive-finder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659157; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asb.benitezmonths.com (Malware_Distribution)"; content:"|03|asb|0d|benitezmonths|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659158; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astrofiber.co.be (Malware_Distribution)"; content:"|0a|astrofiber|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659159; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bekukokymyje.com (Spyware)"; content:"|0c|bekukokymyje|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659160; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bivuxejak.com (Spyware)"; content:"|09|bivuxejak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659161; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bivuzygaden.com (Spyware)"; content:"|0b|bivuzygaden|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659162; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bllkuhftropiwymr.com ()"; content:"|10|bllkuhftropiwymr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659163; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmlbnd.com (Malware_Distribution)"; content:"|06|bmlbnd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659164; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bpmlhpuogveluyobjb.com ()"; content:"|12|bpmlhpuogveluyobjb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659165; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup btfkjkqv.com ()"; content:"|08|btfkjkqv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659166; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunxomdqokknkkllvkr.com ()"; content:"|13|bunxomdqokknkkllvkr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659167; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bvkdfvxoqxsabk.com ()"; content:"|0e|bvkdfvxoqxsabk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659168; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bxnrxuyjcytf.com ()"; content:"|0c|bxnrxuyjcytf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659169; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bygfsdfmrwbhlghll.com ()"; content:"|11|bygfsdfmrwbhlghll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659170; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byraiyodqfdx.com ()"; content:"|0c|byraiyodqfdx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659171; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cajarihejeluw.com (Spyware)"; content:"|0d|cajarihejeluw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659172; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carrerfullezz.com ()"; content:"|0d|carrerfullezz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659173; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cascotqhij.com ()"; content:"|0a|cascotqhij|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659174; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catvfmsxowehqvfahu.com ()"; content:"|12|catvfmsxowehqvfahu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659175; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccquxmelkltnucyqv.com ()"; content:"|11|ccquxmelkltnucyqv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659176; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccsnpnqxii.com ()"; content:"|0a|ccsnpnqxii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659177; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cimuxorazag.com (Spyware)"; content:"|0b|cimuxorazag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659178; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cjemaqojxac.com ()"; content:"|0b|cjemaqojxac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659179; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckgryagcibbcf.com ()"; content:"|0d|ckgryagcibbcf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659180; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cmuhommmdlmhy.com ()"; content:"|0d|cmuhommmdlmhy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659181; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cncvxhadekwnybnv.com ()"; content:"|10|cncvxhadekwnybnv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659182; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpgl.net (Malware_Distribution)"; content:"|04|cpgl|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659183; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpmsussgpibatpmswq.com ()"; content:"|12|cpmsussgpibatpmswq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659184; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cqlmxlukplhlfdo.com ()"; content:"|0f|cqlmxlukplhlfdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659185; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cqlnwqaioac.com ()"; content:"|0b|cqlnwqaioac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659186; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cybanuvegigud.com (Fake_AV)"; content:"|0d|cybanuvegigud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659187; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deejayx.gicp.net ()"; content:"|07|deejayx|04|gicp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659188; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egcftpguclkoi.com ()"; content:"|0d|egcftpguclkoi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659189; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egvqomxmea.com ()"; content:"|0a|egvqomxmea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659190; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eijahjdmm.com ()"; content:"|09|eijahjdmm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659191; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ejjogggfqcmc.com ()"; content:"|0c|ejjogggfqcmc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659192; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elieidkolpc.com ()"; content:"|0b|elieidkolpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659193; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eljmrnwualb.com ()"; content:"|0b|eljmrnwualb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659194; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eolgavefbsntlobsnpp.com ()"; content:"|13|eolgavefbsntlobsnpp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659195; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erfhytwpgitkpgudo.com ()"; content:"|11|erfhytwpgitkpgudo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659196; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ervffluceipmfb.com ()"; content:"|0e|ervffluceipmfb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659197; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expecvmanfaydv.com ()"; content:"|0e|expecvmanfaydv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659198; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fazobugylov.com (Spyware)"; content:"|0b|fazobugylov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659199; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdkasoupvgxigejgdfb.com ()"; content:"|13|fdkasoupvgxigejgdfb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659200; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgvkxjvghdulfrx.com ()"; content:"|0f|fgvkxjvghdulfrx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659201; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiblolpp.com ()"; content:"|08|fiblolpp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659202; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fidjlfphserhycexjhf.com ()"; content:"|13|fidjlfphserhycexjhf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659203; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fkcxdfiv.com ()"; content:"|08|fkcxdfiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659204; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fksudkswknxd.com ()"; content:"|0c|fksudkswknxd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659205; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fktpfwoqpgcagpal.com ()"; content:"|10|fktpfwoqpgcagpal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659206; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fokvmmygnngm.com ()"; content:"|0c|fokvmmygnngm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659207; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fycypururavob.com (Fake_AV)"; content:"|0d|fycypururavob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659208; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gavotataran.com (Spyware)"; content:"|0b|gavotataran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659209; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gawezevahu.com (Spyware)"; content:"|0a|gawezevahu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659210; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtc123.com (Malware_Distribution)"; content:"|06|gtc123|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659211; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gypadakidepi.com (Spyware)"; content:"|0c|gypadakidepi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659212; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hijurefugeb.com (Spyware)"; content:"|0b|hijurefugeb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659213; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihoxyanyker.com ()"; content:"|0b|ihoxyanyker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659214; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iilasqwag.com ()"; content:"|09|iilasqwag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659215; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iljmekbkcukps.com ()"; content:"|0d|iljmekbkcukps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659216; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iokxcthosa.com ()"; content:"|0a|iokxcthosa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659217; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irfldtfkhgyrpsarcje.com ()"; content:"|13|irfldtfkhgyrpsarcje|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659218; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isuhxkbqqxuauhdwn.com ()"; content:"|11|isuhxkbqqxuauhdwn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659219; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itehtxcch.com ()"; content:"|09|itehtxcch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659220; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuhohaeqgpikwwgvkki.com ()"; content:"|13|iuhohaeqgpikwwgvkki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659221; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixjtpaxclwhxmadp.com ()"; content:"|10|ixjtpaxclwhxmadp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659222; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixnaxrqn.com ()"; content:"|08|ixnaxrqn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659223; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixsoscorrrqvyd.com ()"; content:"|0e|ixsoscorrrqvyd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659224; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iyaxaucrvnhmkylya.com ()"; content:"|11|iyaxaucrvnhmkylya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659225; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabdfnuridle.com ()"; content:"|0c|jabdfnuridle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659226; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jatevywohulo.com (Spyware)"; content:"|0c|jatevywohulo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659227; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jbkjkngvaiwaxr.com ()"; content:"|0e|jbkjkngvaiwaxr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659228; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jdrqnbtklqwqrv.com ()"; content:"|0e|jdrqnbtklqwqrv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659229; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jexgpprgph.com ()"; content:"|0a|jexgpprgph|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659230; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jfvgelaqyfhxygq.com ()"; content:"|0f|jfvgelaqyfhxygq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659231; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jfvxpfbgo.com ()"; content:"|09|jfvxpfbgo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659232; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhfugjtncuvsuumnks.com ()"; content:"|12|jhfugjtncuvsuumnks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659233; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jihamisunos.com (Spyware)"; content:"|0b|jihamisunos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659234; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjfcilvuchkjvutlho.com ()"; content:"|12|jjfcilvuchkjvutlho|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659235; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jktlguslfhcwqkmai.com ()"; content:"|11|jktlguslfhcwqkmai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659236; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jmvkyepiiqyixw.com ()"; content:"|0e|jmvkyepiiqyixw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659237; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jnjgogpcehsdkbnl.com ()"; content:"|10|jnjgogpcehsdkbnl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659238; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jnpquwdupgauq.com ()"; content:"|0d|jnpquwdupgauq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659239; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpaaommxplsmmnnp.com ()"; content:"|10|jpaaommxplsmmnnp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659240; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jufxfkajvqmjljumvuq.com ()"; content:"|13|jufxfkajvqmjljumvuq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659241; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juvizovih.com (Spyware)"; content:"|09|juvizovih|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659242; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jxnbdfwh.com ()"; content:"|08|jxnbdfwh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659243; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyvfsnsqddbgxq.com ()"; content:"|0e|jyvfsnsqddbgxq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659244; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kbadlfpgtec.com ()"; content:"|0b|kbadlfpgtec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659245; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcpxjxrmvurhfe.com ()"; content:"|0e|kcpxjxrmvurhfe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659246; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kgrrxfmyixossjmk.com ()"; content:"|10|kgrrxfmyixossjmk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659247; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiiwacbehxexixl.com ()"; content:"|0f|kiiwacbehxexixl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659248; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjhsrucajdjlbpwwj.com ()"; content:"|11|kjhsrucajdjlbpwwj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659249; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjjeuhhqiwvfnuvvtkd.com ()"; content:"|13|kjjeuhhqiwvfnuvvtkd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659250; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjuldacvvmdffxi.com ()"; content:"|0f|kjuldacvvmdffxi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kofajisatum.com (Spyware)"; content:"|0b|kofajisatum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659252; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kyrohematob.com (Spyware)"; content:"|0b|kyrohematob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659253; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lgsjwixwocm.com ()"; content:"|0b|lgsjwixwocm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659254; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linuxstabs.com (Malware_Distribution)"; content:"|0a|linuxstabs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659255; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lnjrtxcjbiaov.com ()"; content:"|0d|lnjrtxcjbiaov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659256; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lnlhuiitohdvbgmx.com ()"; content:"|10|lnlhuiitohdvbgmx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659257; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lolkcovkfktwhaks.com ()"; content:"|10|lolkcovkfktwhaks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659258; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup losajabevyjydu.com (Spyware)"; content:"|0e|losajabevyjydu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659259; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lpggutwsvtvnmvpxrc.com ()"; content:"|12|lpggutwsvtvnmvpxrc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659260; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lqkdmcplj.com ()"; content:"|09|lqkdmcplj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659261; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lrqxvrqsihwtudox.com ()"; content:"|10|lrqxvrqsihwtudox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659262; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxsnxlqhebftttflob.com ()"; content:"|13|luxsnxlqhebftttflob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659263; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lvmrpvkyo.com ()"; content:"|09|lvmrpvkyo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659264; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lwnfgmpncjubpseh.com ()"; content:"|10|lwnfgmpncjubpseh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659265; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyghwyciguta.com ()"; content:"|0c|lyghwyciguta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659266; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mavjlatqkpuban.com ()"; content:"|0e|mavjlatqkpuban|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659267; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcchphgndpadclga.com ()"; content:"|10|mcchphgndpadclga|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659268; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcnegeytoyh.com ()"; content:"|0b|mcnegeytoyh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659269; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mefqtfwlxrfhguru.com ()"; content:"|10|mefqtfwlxrfhguru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659270; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metuzamygyjo.com (Spyware)"; content:"|0c|metuzamygyjo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659271; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mfsxlnoqvslcyfbl.com ()"; content:"|10|mfsxlnoqvslcyfbl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659272; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mggtqypybfts.com ()"; content:"|0c|mggtqypybfts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659273; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mjuqovvuruldy.com ()"; content:"|0d|mjuqovvuruldy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659274; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mkmngqxwk.com ()"; content:"|09|mkmngqxwk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659275; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mlfymmarbaswncxmn.com ()"; content:"|11|mlfymmarbaswncxmn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659276; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mlhlurqylttjc.com ()"; content:"|0d|mlhlurqylttjc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659277; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmigsmpwmmwtxacq.com ()"; content:"|10|mmigsmpwmmwtxacq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659278; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmmngmrhvvohfnv.com ()"; content:"|0f|mmmngmrhvvohfnv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659279; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmwhewlrckie.com ()"; content:"|0c|mmwhewlrckie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659280; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mpefryhfpwhfvj.com ()"; content:"|0e|mpefryhfpwhfvj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659281; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mryonirvcpm.com ()"; content:"|0b|mryonirvcpm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659282; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mstwcsnvylmullkqh.com ()"; content:"|11|mstwcsnvylmullkqh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659283; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msxuafqnwjhljurmw.com ()"; content:"|11|msxuafqnwjhljurmw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659284; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mwiadfsqcbjkudxd.com ()"; content:"|10|mwiadfsqcbjkudxd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659285; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mwsjitqbf.com (Zeus_Zbot_SpyEye)"; content:"|09|mwsjitqbf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659286; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myqapivaz.com (Spyware)"; content:"|09|myqapivaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659287; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbqealvkhirjn.com (Zeus_Zbot_SpyEye)"; content:"|0d|nbqealvkhirjn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659288; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbvhroptghtmsydrfq.com ()"; content:"|12|nbvhroptghtmsydrfq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659289; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbykkrkevuri.com (Zeus_Zbot_SpyEye)"; content:"|0c|nbykkrkevuri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659290; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netiqugerin.com (Spyware)"; content:"|0b|netiqugerin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659291; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ngwhgabaxkpievvmm.com (Zeus_Zbot_SpyEye)"; content:"|11|ngwhgabaxkpievvmm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659292; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nibycexadytyn.com (Spyware)"; content:"|0d|nibycexadytyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659293; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nirxlosffmarpbp.com ()"; content:"|0f|nirxlosffmarpbp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659294; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nypucevys.com (Spyware)"; content:"|09|nypucevys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659295; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyzysemadyk.com (Spyware)"; content:"|0b|nyzysemadyk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659296; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oxjlrgepfnkvdprbr.com ()"; content:"|11|oxjlrgepfnkvdprbr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659297; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paoxlrmbg.com (Zeus_Zbot_SpyEye)"; content:"|09|paoxlrmbg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659298; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pbfttfgw.com (Zeus_Zbot_SpyEye)"; content:"|08|pbfttfgw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659299; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pbwjbkgdo.com ()"; content:"|09|pbwjbkgdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659300; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdcdcwjwrqsq.com ()"; content:"|0c|pdcdcwjwrqsq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659301; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pekiwimozoha.com (Spyware)"; content:"|0c|pekiwimozoha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659302; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pfkilgedjhq.com (Zeus_Zbot_SpyEye)"; content:"|0b|pfkilgedjhq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659303; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppgessnvvn.com ()"; content:"|0a|ppgessnvvn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659304; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pphxfntktjvhgti.com ()"; content:"|0f|pphxfntktjvhgti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659305; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppwnhnvwnvtggifhbv.com ()"; content:"|12|ppwnhnvwnvtggifhbv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659306; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prcgijpwvrl.com ()"; content:"|0b|prcgijpwvrl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659307; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pvbmlrybufe.com ()"; content:"|0b|pvbmlrybufe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659308; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qadjgxayck.com ()"; content:"|0a|qadjgxayck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659309; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qanmwnpvpcyqsa.com ()"; content:"|0e|qanmwnpvpcyqsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659310; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qbpcpmcijn.com ()"; content:"|0a|qbpcpmcijn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659311; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qdfgqwiovjlfegdcepm.com ()"; content:"|13|qdfgqwiovjlfegdcepm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659312; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qekgxfrk.com (Zeus_Zbot_SpyEye)"; content:"|08|qekgxfrk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659313; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qewgaoursqgghhfwbqa.com (Zeus_Zbot_SpyEye)"; content:"|13|qewgaoursqgghhfwbqa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659314; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qfitnlxp.com ()"; content:"|08|qfitnlxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659315; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjnhsbctfdfpoisvgp.com (Zeus_Zbot_SpyEye)"; content:"|12|qjnhsbctfdfpoisvgp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659316; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlbycfgbpvjwa.com (Zeus_Zbot_SpyEye)"; content:"|0d|qlbycfgbpvjwa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659317; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qnmqexiqrxhvdwgl.com (Zeus_Zbot_SpyEye)"; content:"|10|qnmqexiqrxhvdwgl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659318; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qocakizali.com (Spyware)"; content:"|0a|qocakizali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659319; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qopdypfxhda.com ()"; content:"|0b|qopdypfxhda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659320; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qsxx.cn (Malware_Distribution)"; content:"|04|qsxx|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659321; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sabisocuci.com (Spyware)"; content:"|0a|sabisocuci|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659322; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snpltixygwcpifp.com ()"; content:"|0f|snpltixygwcpifp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659323; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sowevicekem.com (Spyware)"; content:"|0b|sowevicekem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659324; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sphmwjrwlfl.com ()"; content:"|0b|sphmwjrwlfl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659325; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sptihuxubpj.com ()"; content:"|0b|sptihuxubpj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659326; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stleikxkbjwo.com ()"; content:"|0c|stleikxkbjwo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659327; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strhnkjvfskxlwinku.com ()"; content:"|12|strhnkjvfskxlwinku|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659328; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suhfvuljuihmevldp.com ()"; content:"|11|suhfvuljuihmevldp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659329; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suqyjuxumo.com (Spyware)"; content:"|0a|suqyjuxumo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659330; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup svyafurnyrjrrfxjreh.com ()"; content:"|13|svyafurnyrjrrfxjreh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659331; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swtuvuibfapnited.com ()"; content:"|10|swtuvuibfapnited|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659332; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tcpfmbhnlyw.com ()"; content:"|0b|tcpfmbhnlyw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659333; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tekiyftuevgnor.com ()"; content:"|0e|tekiyftuevgnor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659334; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tfgixgmqhdowexm.com ()"; content:"|0f|tfgixgmqhdowexm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659335; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tfpohsjc.com ()"; content:"|08|tfpohsjc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659336; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thkqfhupjgknkqcxhou.com ()"; content:"|13|thkqfhupjgknkqcxhou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659337; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thxkchcnhyssj.com ()"; content:"|0d|thxkchcnhyssj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659338; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ticfmjsce.com ()"; content:"|09|ticfmjsce|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659339; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tivvitter.com (Phishing_and_Theft)"; content:"|09|tivvitter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659340; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tlxfrilp.com ()"; content:"|08|tlxfrilp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659341; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tnueoqahys.com ()"; content:"|0a|tnueoqahys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659342; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trlnhbpanhmspru.com ()"; content:"|0f|trlnhbpanhmspru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659343; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsilfaftadrrs.com ()"; content:"|0d|tsilfaftadrrs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659344; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tthayebvhdmntiyeuxw.com ()"; content:"|13|tthayebvhdmntiyeuxw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659345; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttjerkrdrrowibsipjr.com ()"; content:"|13|ttjerkrdrrowibsipjr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659346; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tufictpfglnlfq.com ()"; content:"|0e|tufictpfglnlfq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659347; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuisyirhweflhvqyxh.com ()"; content:"|12|tuisyirhweflhvqyxh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659348; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tupexbvpmsc.com ()"; content:"|0b|tupexbvpmsc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659349; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tvxwdutxo.com ()"; content:"|09|tvxwdutxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659350; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vimysoqecuci.com (Spyware)"; content:"|0c|vimysoqecuci|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659351; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wohocebutiqy.com (Spyware)"; content:"|0c|wohocebutiqy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659352; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wojucn.com (Malware_Distribution)"; content:"|06|wojucn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659353; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wvogkbbapujp.com ()"; content:"|0c|wvogkbbapujp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659354; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwgxwnil.com ()"; content:"|08|wwgxwnil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659355; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wxurahlisqbmppqss.com ()"; content:"|11|wxurahlisqbmppqss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659356; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcmcupdfcevkgbrue.com ()"; content:"|11|xcmcupdfcevkgbrue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659357; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xekowysysozoj.com (Spyware)"; content:"|0d|xekowysysozoj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659358; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xeucibnop.com ()"; content:"|09|xeucibnop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659359; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xfcdavqouyevtvgjwu.com ()"; content:"|12|xfcdavqouyevtvgjwu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659360; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xiangglgqatolsgfxqi.com ()"; content:"|13|xiangglgqatolsgfxqi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659361; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xihacedugywo.com (Spyware)"; content:"|0c|xihacedugywo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659362; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xioyjfiguiuluff.com ()"; content:"|0f|xioyjfiguiuluff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659363; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xnttkdfunybxgn.com ()"; content:"|0e|xnttkdfunybxgn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659364; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xnuqkdwek.com ()"; content:"|09|xnuqkdwek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659365; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xonibawylabep.com (Spyware)"; content:"|0d|xonibawylabep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659366; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xoodachpaujnikmpp.com ()"; content:"|11|xoodachpaujnikmpp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659367; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xqdrbrjiqwwpahhk.com ()"; content:"|10|xqdrbrjiqwwpahhk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659368; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xsredbpaef.com ()"; content:"|0a|xsredbpaef|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659369; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xumpkgnvdcmhykvdak.com ()"; content:"|12|xumpkgnvdcmhykvdak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659370; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxkoixiiiqpyecxoaka.com ()"; content:"|13|xxkoixiiiqpyecxoaka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659371; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y278k8p45.veteransetting.com (Malware_Distribution)"; content:"|09|y278k8p45|0e|veteransetting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659372; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yarymutdstxwp.com ()"; content:"|0d|yarymutdstxwp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659373; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ybbwxrcoujexdh.com ()"; content:"|0e|ybbwxrcoujexdh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659374; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ybdwipovbicmpekyh.com ()"; content:"|11|ybdwipovbicmpekyh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659375; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ybmhumhymqj.com ()"; content:"|0b|ybmhumhymqj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659376; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zokykajobu.com (Spyware)"; content:"|0a|zokykajobu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659377; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3idiota.info (Malware_Distribution)"; content:"|07|3idiota|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659378; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 91wxw.com ()"; content:"|05|91wxw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659379; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-better-smilea.com ()"; content:"|0f|a-better-smilea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659380; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaaa.forexinvest4.com (Zeus_Zbot_SpyEye)"; content:"|04|aaaa|0c|forexinvest4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659381; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abaumthinklines.com ()"; content:"|0f|abaumthinklines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659382; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abi2wu5qsxmt.com (Botnet_C&C)"; content:"|0c|abi2wu5qsxmt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659383; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ableallwind.com ()"; content:"|0b|ableallwind|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659384; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ablefadhing.com ()"; content:"|0b|ablefadhing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659385; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ableseasame.com ()"; content:"|0b|ableseasame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659386; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abnflashparty.com (Botnet_C&C)"; content:"|0d|abnflashparty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659387; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aboutivreazh.com ()"; content:"|0c|aboutivreazh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659388; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admagnet1.com (Malware_Distribution)"; content:"|09|admagnet1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659389; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adscenterltd.in (Malware_Distribution)"; content:"|0c|adscenterltd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659390; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahtrbny.info ()"; content:"|07|ahtrbny|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659391; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allegiantstaffing.com (Malware_Distribution)"; content:"|11|allegiantstaffing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659392; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asfirey.com (Malware_Distribution)"; content:"|07|asfirey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659393; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aviableupdate.ru (Malware_Distribution)"; content:"|0d|aviableupdate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659394; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besloqawe.com (Malware_Distribution)"; content:"|09|besloqawe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betbits.com (Malware_Distribution)"; content:"|07|betbits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659396; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bing-redirect.com (Malware_Infectors)"; content:"|0d|bing-redirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659397; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citycenter22.com (Malware_Distribution)"; content:"|0c|citycenter22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659398; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crisiscommand.com (Malware_Distribution)"; content:"|0d|crisiscommand|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659399; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutsomd.com (Malware_Distribution)"; content:"|07|cutsomd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659400; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup denitraspetr.com (Botnet_C&C)"; content:"|0c|denitraspetr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgf4d65g45df4g6d546565555.nl.ai ()"; content:"|19|dgf4d65g45df4g6d546565555|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659402; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup divstyleonmouseout.ru ()"; content:"|12|divstyleonmouseout|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659403; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdgsafkgdsfaskfshfgjahsgdf634570.in (Zeus_Zbot_SpyEye)"; content:"|20|fdgsafkgdsfaskfshfgjahsgdf634570|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659404; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdsfdsfsuuuuu.nl.ai ()"; content:"|0d|fdsfdsfsuuuuu|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659405; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdthhfy.info ()"; content:"|07|fdthhfy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659406; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funkitloudit.gv.vg (Malware_Distribution)"; content:"|0c|funkitloudit|02|gv|02|vg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659407; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdeuaumgmcp.com (Malware_Infectors)"; content:"|0b|gdeuaumgmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659408; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gggggghhhhhhhhh.nl ()"; content:"|0f|gggggghhhhhhhhh|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659409; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helali.tk (Malware_Infectors)"; content:"|06|helali|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659410; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellodolly2.com (Malware_Infectors)"; content:"|0b|hellodolly2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659411; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellokitty2.com (Malware_Infectors)"; content:"|0b|hellokitty2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659412; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horoscopeamour.100webspace.net (Malware_Distribution)"; content:"|0e|horoscopeamour|0b|100webspace|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659413; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup humusliving.com (Malware_Distribution)"; content:"|0b|humusliving|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659414; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup husde478sje.com (Malware_Distribution)"; content:"|0b|husde478sje|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659415; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilweyu.info ()"; content:"|06|ilweyu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659416; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilyger.info ()"; content:"|06|ilyger|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659417; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intimgsave.ru ()"; content:"|0a|intimgsave|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659418; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iufeer.info ()"; content:"|06|iufeer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659419; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iyufeg.info ()"; content:"|06|iyufeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659420; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iyutfe.info ()"; content:"|06|iyutfe|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659421; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjjjjjjjnnnnhhhhhhhh.nl.ai ()"; content:"|14|jjjjjjjjnnnnhhhhhhhh|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659422; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jtryvt.info ()"; content:"|06|jtryvt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659423; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyoshg.info ()"; content:"|06|jyoshg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659424; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kghxfupkmcp.com (Malware_Infectors)"; content:"|0b|kghxfupkmcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659425; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjurtey.info ()"; content:"|07|kjurtey|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659426; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kordelashop.com (Malware_Infectors)"; content:"|0b|kordelashop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659427; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ktyger.info ()"; content:"|06|ktyger|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659428; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ktygvri.info ()"; content:"|07|ktygvri|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659429; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kuytid.info ()"; content:"|06|kuytid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659430; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kuytrei.info ()"; content:"|07|kuytrei|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659431; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kytcue.info ()"; content:"|06|kytcue|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659432; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l6tebt.info ()"; content:"|06|l6tebt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659433; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liteautotop.cn (Malware_Distribution)"; content:"|0b|liteautotop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659434; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lituyv.info ()"; content:"|06|lituyv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659435; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liutyft.info ()"; content:"|07|liutyft|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659436; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liuytc.info ()"; content:"|06|liuytc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659437; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lookgreat-now.com ()"; content:"|0d|lookgreat-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659438; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loralyncassie.com ()"; content:"|0d|loralyncassie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659439; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loranexanle.com ()"; content:"|0b|loranexanle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659440; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup losdsodemoss.com ()"; content:"|0c|losdsodemoss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659441; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lose-pounds-nowa.com ()"; content:"|10|lose-pounds-nowa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659442; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup losidko.net ()"; content:"|07|losidko|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659443; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotlakithpii.com ()"; content:"|0c|lotlakithpii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659444; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotoftinnumbip.com ()"; content:"|0e|lotoftinnumbip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659445; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lottatiffi.com ()"; content:"|0a|lottatiffi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659446; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loutitiaingeberg.com ()"; content:"|10|loutitiaingeberg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659447; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovioinwdoli.com ()"; content:"|0c|lovioinwdoli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659448; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loweyeyear.com ()"; content:"|0a|loweyeyear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659449; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luyfjr.info ()"; content:"|06|luyfjr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659450; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyutfy.info ()"; content:"|06|lyutfy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659451; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medsweb.ru (Botnet_C&C)"; content:"|07|medsweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659452; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meelips.info ()"; content:"|07|meelips|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659453; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup misija.eu (Malware_Distribution)"; content:"|06|misija|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659454; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msnsolution.nicaze.net (Malware_Distribution)"; content:"|0b|msnsolution|06|nicaze|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mudpots.com (Malware_Distribution)"; content:"|07|mudpots|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659455; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mynameisbigsecreet.in (Zeus_Zbot_SpyEye)"; content:"|12|mynameisbigsecreet|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659456; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newstaticup.com (Malware_Distribution)"; content:"|0b|newstaticup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659457; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nirenbak23.com (Malware_Distribution)"; content:"|0a|nirenbak23|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659458; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns1google.com (Malware_Infectors)"; content:"|09|ns1google|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659459; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyfilmlife.cn (Malware_Distribution)"; content:"|0a|nyfilmlife|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659460; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oityfkt.info ()"; content:"|07|oityfkt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659461; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ottgtew.info ()"; content:"|07|ottgtew|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659462; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oyadantel.net (Malware_Distribution)"; content:"|09|oyadantel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659463; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oydfue.info ()"; content:"|06|oydfue|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659464; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prefs-save.ru ()"; content:"|0a|prefs-save|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659465; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redserp.com (Malware_Distribution)"; content:"|07|redserp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659466; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-intimg.ru ()"; content:"|0b|save-intimg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659467; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sertwey.ru (Malware_Distribution)"; content:"|07|sertwey|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659468; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smallsax.ru (Malware_Distribution)"; content:"|08|smallsax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659469; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sssr.rv.ua (Botnet_C&C)"; content:"|04|sssr|02|rv|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659470; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sssssssss222222222.nl.ai ()"; content:"|12|sssssssss222222222|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659471; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stamps9407.com.ar (Malware_Distribution)"; content:"|0a|stamps9407|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659472; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stopitplz.com (Malware_Distribution)"; content:"|09|stopitplz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659473; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup synapsetest.ru (Zeus_Zbot_SpyEye)"; content:"|0b|synapsetest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659474; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trianti.com (Malware_Distribution)"; content:"|07|trianti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659475; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uyjtrc.info ()"; content:"|06|uyjtrc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659476; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uytrdw.info ()"; content:"|06|uytrdw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659477; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vantagensfimdeano.com (Phishing_and_Theft)"; content:"|11|vantagensfimdeano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659486; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vellalink.com ()"; content:"|09|vellalink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659478; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wautilber.com (Malware_Distribution)"; content:"|09|wautilber|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659479; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows7ultimate.ibusinessdot.com (Malware_Distribution)"; content:"|10|windows7ultimate|0c|ibusinessdot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659480; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup withijs.com (Malware_Distribution)"; content:"|07|withijs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659481; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wmcoyg.info ()"; content:"|06|wmcoyg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659482; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wooody27.com (Malware_Infectors)"; content:"|08|wooody27|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659483; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xnquhemnxq.ddns.name ()"; content:"|0a|xnquhemnxq|04|ddns|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659484; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yandcx.com (Botnet_C&C)"; content:"|06|yandcx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659485; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alwaasim.com (Malware_Infectors)"; content:"|08|alwaasim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619251; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapscannerprotectionxp.com (Spyware)"; content:"|18|cheapscannerprotectionxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clck.ru (Malware_Distribution)"; content:"|04|clck|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnshop.com (Malware_Distribution)"; content:"|06|dnshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628395; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planete-lolo.com (Malware_Distribution)"; content:"|0c|planete-lolo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webcamstoolbar.com (Malware_Distribution)"; content:"|0e|webcamstoolbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 11334.com (Malware_Distribution)"; content:"|05|11334|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659487; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2b8c7a6edc54da9095a28a7c5572b618.co.cc (Malware_Distribution)"; content:"|20|2b8c7a6edc54da9095a28a7c5572b618|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659488; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 56b2fc002ed6233f40e9d7ea7be2171c.co.cc (Malware_Distribution)"; content:"|20|56b2fc002ed6233f40e9d7ea7be2171c|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659489; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abcasmportal.net (Malware_Distribution)"; content:"|0c|abcasmportal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659490; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ayathirai.com (SEO_Fraud)"; content:"|09|ayathirai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659491; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b832e18984f78e6e1f9b187e7bfd90ea.co.cc (Malware_Distribution)"; content:"|20|b832e18984f78e6e1f9b187e7bfd90ea|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659492; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bamprint.com (Malware_Distribution)"; content:"|08|bamprint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659493; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baywireless.net (Malware_Distribution)"; content:"|0b|baywireless|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659494; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bhxwg.biz (Malware_Distribution)"; content:"|05|bhxwg|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659495; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bosabanoduwagur.co.cc (Malware_Distribution)"; content:"|0f|bosabanoduwagur|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659496; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bpbqh.org (Malware_Distribution)"; content:"|05|bpbqh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659497; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bpqpiincvb.org (Malware_Distribution)"; content:"|0a|bpqpiincvb|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659498; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c36.ru (Malware_Distribution)"; content:"|03|c36|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659499; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cevulewytubiloq.co.cc (Malware_Distribution)"; content:"|0f|cevulewytubiloq|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659500; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanusahousestoday.info (Malware_Distribution)"; content:"|13|cleanusahousestoday|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659501; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codememx.org (Zeus_Zbot_SpyEye)"; content:"|08|codememx|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659502; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coguar-systems-support.info (Spyware)"; content:"|16|coguar-systems-support|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659503; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cqoyvmvsh.biz (Malware_Distribution)"; content:"|09|cqoyvmvsh|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659504; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupit-dom.ru (Malware_Distribution)"; content:"|09|cupit-dom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659505; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dewanperwakilanrakyat.tk (Malware_Distribution)"; content:"|15|dewanperwakilanrakyat|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659506; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dohxahjoo.com (SEO_Fraud)"; content:"|09|dohxahjoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659507; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvzrqzdfeo.org (Malware_Distribution)"; content:"|0a|dvzrqzdfeo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659508; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edqdcbdls.info (Malware_Distribution)"; content:"|09|edqdcbdls|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659509; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elemart.ru (Malware_Distribution)"; content:"|07|elemart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659510; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elemix.ru (Malware_Distribution)"; content:"|06|elemix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659511; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endorphyne.net (Malware_Distribution)"; content:"|0a|endorphyne|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659512; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esdashqpxd.info (Malware_Distribution)"; content:"|0a|esdashqpxd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659513; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fmodjiaskv.org (Malware_Distribution)"; content:"|0a|fmodjiaskv|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659514; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyyrbkrte.biz (Malware_Distribution)"; content:"|09|fyyrbkrte|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659515; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghosttrick.ru ()"; content:"|0a|ghosttrick|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659516; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gihuwakiricexyp.co.cc (Malware_Distribution)"; content:"|0f|gihuwakiricexyp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659517; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gomkhkfjm.biz (Malware_Distribution)"; content:"|09|gomkhkfjm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659518; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodofic.in (Malware_Distribution)"; content:"|08|goodofic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659519; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenballsoft.com (Zeus_Zbot_SpyEye)"; content:"|0d|greenballsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659520; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gydbcyhzw.info (Malware_Distribution)"; content:"|09|gydbcyhzw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659521; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huhfghf39.tk (Malware_Distribution)"; content:"|09|huhfghf39|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659522; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intersecweb.com (Spyware)"; content:"|0b|intersecweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659523; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqpjftc.org (Malware_Distribution)"; content:"|07|iqpjftc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659524; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhbqptzsax.biz (Malware_Distribution)"; content:"|0a|jhbqptzsax|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659525; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jojofygosarobym.co.cc (Malware_Distribution)"; content:"|0f|jojofygosarobym|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659526; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kibivilale-nema.mindnmagick.com ()"; content:"|0f|kibivilale-nema|0b|mindnmagick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659527; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjjjfnt.cc (Malware_Distribution)"; content:"|07|kjjjfnt|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659528; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kqifuadx.cc (Malware_Distribution)"; content:"|08|kqifuadx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659529; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ksgsomfgnx.org (Malware_Distribution)"; content:"|0a|ksgsomfgnx|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659530; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laebohlay.com (SEO_Fraud)"; content:"|09|laebohlay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659531; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ldhhzkxkep.info (Malware_Distribution)"; content:"|0a|ldhhzkxkep|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659532; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyepybw.cc (Malware_Distribution)"; content:"|07|lyepybw|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659533; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyzovacka.szm.com (Malware_Distribution)"; content:"|09|lyzovacka|03|szm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659534; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyzovacka.szm.sk (Malware_Distribution)"; content:"|09|lyzovacka|03|szm|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659535; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mvgapzbp.biz (Malware_Distribution)"; content:"|08|mvgapzbp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659536; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nahinividewisyx.co.cc (Malware_Distribution)"; content:"|0f|nahinividewisyx|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659537; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nepyrakykamasul.co.cc (Malware_Distribution)"; content:"|0f|nepyrakykamasul|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659538; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-themes.net (Malware_Distribution)"; content:"|0a|new-themes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659539; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup npanelsrv.info (Malware_Distribution)"; content:"|09|npanelsrv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659540; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nrxrsjh.org (Malware_Distribution)"; content:"|07|nrxrsjh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659541; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oathaesha.com (SEO_Fraud)"; content:"|09|oathaesha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659542; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online68.co.cc (Malware_Distribution)"; content:"|08|online68|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659543; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineofficemail.co.uk (Malware_Distribution)"; content:"|10|onlineofficemail|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659544; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porshe911z.info (Zeus_Zbot_SpyEye)"; content:"|0a|porshe911z|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659545; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qbqit.org (Malware_Distribution)"; content:"|05|qbqit|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659546; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qmeoakljn.biz (Malware_Distribution)"; content:"|09|qmeoakljn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659547; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qmeyv.info (Malware_Distribution)"; content:"|05|qmeyv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659548; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qudbcyif.info (Malware_Distribution)"; content:"|08|qudbcyif|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659549; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quden.biz (Malware_Distribution)"; content:"|05|quden|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659550; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qudmvgj.org (Malware_Distribution)"; content:"|07|qudmvgj|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659551; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rickstudio.ru (Zeus_Zbot_SpyEye)"; content:"|0a|rickstudio|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659552; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rmnoyzzk.org (Malware_Distribution)"; content:"|08|rmnoyzzk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659553; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rzavsxatgx.info (Malware_Distribution)"; content:"|0a|rzavsxatgx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659554; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-defensehq.kwik.to (Malware_Distribution)"; content:"|0e|save-defensehq|04|kwik|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659555; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sejoxulowexurog.co.cc (Malware_Distribution)"; content:"|0f|sejoxulowexurog|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659556; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup souxvco.biz (Malware_Distribution)"; content:"|07|souxvco|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659557; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sulusize.com ()"; content:"|08|sulusize|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659558; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taemaidoo.com (SEO_Fraud)"; content:"|09|taemaidoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659559; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tfjhtaez.org (Malware_Distribution)"; content:"|08|tfjhtaez|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659560; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tfjorhc.org (Malware_Distribution)"; content:"|07|tfjorhc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659561; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tpkkebsj.biz (Malware_Distribution)"; content:"|08|tpkkebsj|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659562; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tvzngourvp.info (Malware_Distribution)"; content:"|0a|tvzngourvp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659563; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujyafod.uraatoor.info (Malware_Distribution)"; content:"|07|ujyafod|08|uraatoor|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659564; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uniatea8.tk (Malware_Distribution)"; content:"|08|uniatea8|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659565; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uqspghnz.info (Malware_Distribution)"; content:"|08|uqspghnz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659566; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wbucb.info (Malware_Distribution)"; content:"|05|wbucb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659567; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wchnzq.info (Malware_Distribution)"; content:"|06|wchnzq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659568; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whoamfor.in (Malware_Distribution)"; content:"|08|whoamfor|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659569; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wineloans.net ()"; content:"|09|wineloans|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659570; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wordbean.net ()"; content:"|08|wordbean|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659571; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wordgodand.com ()"; content:"|0a|wordgodand|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659572; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup world-friendship.net ()"; content:"|10|world-friendship|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659573; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worstpillsdrugstore.com ()"; content:"|13|worstpillsdrugstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659574; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worvmw.com ()"; content:"|06|worvmw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659575; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wouldlisfiguashi.com ()"; content:"|10|wouldlisfiguashi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659576; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wouldwillhool.com ()"; content:"|0d|wouldwillhool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659577; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woulpfytusual.com ()"; content:"|0d|woulpfytusual|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659578; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wqeq42cc12.com ()"; content:"|0a|wqeq42cc12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659579; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wtexvktkgpf.org (Malware_Distribution)"; content:"|0b|wtexvktkgpf|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659580; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwygmfu.biz (Malware_Distribution)"; content:"|07|wwygmfu|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659581; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xfsrxc.info (Malware_Distribution)"; content:"|06|xfsrxc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659582; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xrmidgkxbq.biz (Malware_Distribution)"; content:"|0a|xrmidgkxbq|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659583; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ylfqx.org (Malware_Distribution)"; content:"|05|ylfqx|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659584; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yotduykd.org (Malware_Distribution)"; content:"|08|yotduykd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659585; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zzlfb.org (Malware_Distribution)"; content:"|05|zzlfb|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659586; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zzlivua.info (Malware_Distribution)"; content:"|07|zzlivua|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659587; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clrjagxamkwkyxuk.com ()"; content:"|10|clrjagxamkwkyxuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659588; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foruminspace.com (Malware_Infectors)"; content:"|0c|foruminspace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659649; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kujrfpkp8xxf2viymsj.com ()"; content:"|13|kujrfpkp8xxf2viymsj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659589; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1god.in ()"; content:"|04|1god|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659590; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1lavardefest2011.net63.net (Phishing_and_Theft)"; content:"|10|1lavardefest2011|05|net63|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659591; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1o345.info ()"; content:"|05|1o345|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659592; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1op45.info ()"; content:"|05|1op45|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659593; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2012-my-happy.com ()"; content:"|0d|2012-my-happy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659594; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2012myownhappy.com ()"; content:"|0e|2012myownhappy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659595; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 543oh.info ()"; content:"|05|543oh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659596; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 54mo1.info ()"; content:"|05|54mo1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659597; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 54po1.info ()"; content:"|05|54po1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659598; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admarket2.in.ua (Malware_Distribution)"; content:"|09|admarket2|02|in|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659599; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adxdnet.net (Malware_Infectors)"; content:"|07|adxdnet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659600; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aerostrips.com ()"; content:"|0a|aerostrips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659601; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aj-auto-exhibitions.co.cc (Malware_Distribution)"; content:"|13|aj-auto-exhibitions|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659602; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akvitea.com ()"; content:"|07|akvitea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659603; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alurbrilance.com ()"; content:"|0c|alurbrilance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659604; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ar-facebook.x90x.net (Phishing_and_Theft)"; content:"|0b|ar-facebook|04|x90x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659605; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arowipes.com ()"; content:"|08|arowipes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659606; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arrayhansen.com ()"; content:"|0b|arrayhansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659607; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup available78.de.ms ()"; content:"|0b|available78|02|de|02|ms"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659608; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avangeit.com ()"; content:"|08|avangeit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659609; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avdonw.comuv.com (Malware_Distribution)"; content:"|06|avdonw|05|comuv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659610; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup backozifice.net ()"; content:"|0b|backozifice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659611; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitcast.in ()"; content:"|07|bitcast|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659612; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitcube.in ()"; content:"|07|bitcube|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659613; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitechnica.in ()"; content:"|0a|bitechnica|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659614; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitfire.in ()"; content:"|07|bitfire|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659615; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitware.in ()"; content:"|07|bitware|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659616; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitwire.in ()"; content:"|07|bitwire|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659617; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boeingmiles.com ()"; content:"|0b|boeingmiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659618; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessnfamily.com ()"; content:"|0f|businessnfamily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659619; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup child-re-ninth-ebusiness.com ()"; content:"|18|child-re-ninth-ebusiness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659620; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup childregardingninthebusiness.com ()"; content:"|1c|childregardingninthebusiness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659621; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup childreninthebusiness.com ()"; content:"|15|childreninthebusiness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659622; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup childsubjectninthcompany.com ()"; content:"|18|childsubjectninthcompany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659623; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup childsubjectninthebiz.com ()"; content:"|15|childsubjectninthebiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659624; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup childsubjectninthebusiness.com ()"; content:"|1a|childsubjectninthebusiness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659625; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chronvofu.dlinkddns.com ()"; content:"|09|chronvofu|09|dlinkddns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659626; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collection-hansen.com ()"; content:"|11|collection-hansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659627; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup companyandfamily.com ()"; content:"|10|companyandfamily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659628; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup companynfamily.com ()"; content:"|0e|companynfamily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659629; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup companynpeople.com ()"; content:"|0e|companynpeople|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659630; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contador2012.com.br (Botnet_C&C)"; content:"|0c|contador2012|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659631; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolwebzuzuzu.ru ()"; content:"|0d|coolwebzuzuzu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659632; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crussail-global.com (Malware_Distribution)"; content:"|0f|crussail-global|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659633; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup custom-t-shirtsfromhansen.com ()"; content:"|19|custom-t-shirtsfromhansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659634; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup customtshirtsfromhansen.com ()"; content:"|17|customtshirtsfromhansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659635; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutestsix.com ()"; content:"|09|cutestsix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659636; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender.x90x.net (Phishing_and_Theft)"; content:"|08|defender|04|x90x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659637; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domtrixsov.com ()"; content:"|0a|domtrixsov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659638; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doofyonmycolg.ru ()"; content:"|0d|doofyonmycolg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659639; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doubleglazingparts.co.uk (Malware_Distribution)"; content:"|12|doubleglazingparts|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659640; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drinki.in ()"; content:"|06|drinki|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659641; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ease.breastedchestedboobiestits.com ()"; content:"|04|ease|1a|breastedchestedboobiestits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659642; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extentthahansen.com ()"; content:"|0f|extentthahansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659643; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup family-ownedcompany.com ()"; content:"|13|family-ownedcompany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659644; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup familycommercial.com ()"; content:"|10|familycommercial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659645; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup familyownedcompany.com ()"; content:"|12|familyownedcompany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659646; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fc.webmasterpro.de (Malware_Infectors)"; content:"|02|fc|0c|webmasterpro|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617401; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filkso.in ()"; content:"|06|filkso|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659647; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flippingpuppies.net ()"; content:"|0f|flippingpuppies|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659648; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeautomag.info ()"; content:"|0b|freeautomag|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659650; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeholidaynew.com ()"; content:"|0e|freeholidaynew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659651; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freemmsservice.com ()"; content:"|0e|freemmsservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659652; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freetracking02234.info ()"; content:"|11|freetracking02234|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659653; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funnytshirtsfromhansen.com ()"; content:"|16|funnytshirtsfromhansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659654; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glad-year.com ()"; content:"|09|glad-year|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659655; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globaltracking02234.info ()"; content:"|13|globaltracking02234|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659656; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup great-happy.com ()"; content:"|0b|great-happy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659657; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatglad.com ()"; content:"|09|greatglad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659658; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwc2012.com (Malware_Distribution)"; content:"|07|gwc2012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659659; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happy-period.com ()"; content:"|0c|happy-period|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659660; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happy-term.com ()"; content:"|0a|happy-term|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659661; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happychock.biz ()"; content:"|0a|happychock|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659662; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happytwelvemonths.com ()"; content:"|11|happytwelvemonths|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659663; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdfhfd.c0m.li (Malware_Distribution)"; content:"|06|hdfhfd|03|c0m|02|li"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659664; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdsghsd.coom.in (Malware_Distribution)"; content:"|07|hdsghsd|04|coom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659665; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hession0345.dnsrd.com (Malware_Infectors)"; content:"|0b|hession0345|05|dnsrd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659666; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hkelecservestar.net76.net (Phishing_and_Theft)"; content:"|0f|hkelecservestar|05|net76|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659667; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ho345.info ()"; content:"|05|ho345|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659668; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holidaygreat.com ()"; content:"|0c|holidaygreat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659669; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holidaynewsite.com ()"; content:"|0e|holidaynewsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659670; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iflos.com ()"; content:"|05|iflos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659671; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imported-c-limited.co.uk ()"; content:"|12|imported-c-limited|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659672; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infonews.ath.cx (Malware_Infectors)"; content:"|08|infonews|03|ath|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659673; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivairiu.com ()"; content:"|07|ivairiu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659674; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j-jassocies.com (Malware_Distribution)"; content:"|0b|j-jassocies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659675; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joyful-year.com ()"; content:"|0b|joyful-year|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659676; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsijdewhg.com ()"; content:"|09|jsijdewhg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659677; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kalalog-testov.com ()"; content:"|0e|kalalog-testov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659678; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kerengga.x90x.net (Phishing_and_Theft)"; content:"|08|kerengga|04|x90x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659679; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krasivayfigura.com ()"; content:"|0e|krasivayfigura|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659680; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latest-happy.com ()"; content:"|0c|latest-happy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659681; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup libraryhansen.com ()"; content:"|0d|libraryhansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659682; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkskjje43d.com ()"; content:"|0a|lkskjje43d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659683; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maconassint.com (Malware_Distribution)"; content:"|0b|maconassint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659684; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makdacs00.com ()"; content:"|09|makdacs00|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659685; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makiajdleavseh.com ()"; content:"|0e|makiajdleavseh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659686; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-protection-center.com (Spyware)"; content:"|19|malware-protection-center|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659687; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mapping-cs.net16.net (Malware_Distribution)"; content:"|0a|mapping-cs|05|net16|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659688; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masplacer.es (Malware_Distribution)"; content:"|09|masplacer|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659689; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mc-3.in ()"; content:"|04|mc-3|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659690; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup merry-year.com ()"; content:"|0a|merry-year|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659691; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metropannolike.in ()"; content:"|0e|metropannolike|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659692; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft.acmetoy.com (Malware_Infectors)"; content:"|09|microsoft|07|acmetoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659693; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft.instanthq.com (Malware_Infectors)"; content:"|09|microsoft|09|instanthq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659694; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft.proxydns.com (Malware_Infectors)"; content:"|09|microsoft|08|proxydns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659695; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobiletracking02234.info ()"; content:"|13|mobiletracking02234|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659696; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modern-happy.com ()"; content:"|0c|modern-happy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659697; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muravied222.com ()"; content:"|0b|muravied222|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659698; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myholidaynew.com ()"; content:"|0c|myholidaynew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659699; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myskyinfo.in ()"; content:"|09|myskyinfo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newitem.allalla.com (Phishing_and_Theft)"; content:"|07|newitem|07|allalla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659701; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nonewfb2012.x90x.net (Phishing_and_Theft)"; content:"|0b|nonewfb2012|04|x90x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odnonoshnicy.com ()"; content:"|0c|odnonoshnicy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659703; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oeit.in ()"; content:"|04|oeit|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659704; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogpertlastermatrwq.net (Spyware)"; content:"|12|ogpertlastermatrwq|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659705; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olanuc.dlinkddns.com ()"; content:"|06|olanuc|09|dlinkddns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659706; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetelephonika.info ()"; content:"|11|onlinetelephonika|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659707; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup optimizzzm.ru (Zeus_Zbot_SpyEye)"; content:"|0a|optimizzzm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659708; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orfasde.dlinkddns.com ()"; content:"|07|orfasde|09|dlinkddns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659709; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p38-adsrv.nl.ai ()"; content:"|09|p38-adsrv|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659710; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p66-adservices.nl.ai ()"; content:"|0e|p66-adservices|02|nl|02|ai"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659711; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pampleaca.x90x.net (Malware_Distribution)"; content:"|09|pampleaca|04|x90x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659712; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pedastera.cu.cc ()"; content:"|09|pedastera|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659713; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfil.x90x.net (Phishing_and_Theft)"; content:"|06|perfil|04|x90x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659714; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plsk3mme.com ()"; content:"|08|plsk3mme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659715; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popa.16mb.com (Malware_Distribution)"; content:"|04|popa|04|16mb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659716; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portfoliohansen.com ()"; content:"|0f|portfoliohansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659717; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q234.info ()"; content:"|04|q234|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659718; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup range-the-hansen.com ()"; content:"|10|range-the-hansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659719; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restauracjazosienka.com (Malware_Distribution)"; content:"|13|restauracjazosienka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659720; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rifalogs.com ()"; content:"|08|rifalogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659721; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rokantop.comeze.com (Malware_Distribution)"; content:"|08|rokantop|06|comeze|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659722; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s00n.in ()"; content:"|04|s00n|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659723; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-t-shirtsfromhansen.com ()"; content:"|17|safe-t-shirtsfromhansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659724; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safetshirtsfromhansen.com ()"; content:"|15|safetshirtsfromhansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659725; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saldo7.us ()"; content:"|06|saldo7|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659726; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveixsuite.com (Spyware)"; content:"|0b|saveixsuite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup schenledi.dlinkddns.com ()"; content:"|09|schenledi|09|dlinkddns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659728; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seifancold.dlinkddns.com ()"; content:"|0a|seifancold|09|dlinkddns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659729; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serdjuchka.biz ()"; content:"|0a|serdjuchka|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659730; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sgsk43tgsdlflfbcbg.uni.me ()"; content:"|12|sgsk43tgsdlflfbcbg|03|uni|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659731; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skyinfo.in ()"; content:"|07|skyinfo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659732; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-prysham.com ()"; content:"|0c|stop-prysham|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659733; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tanildirtystories.com ()"; content:"|11|tanildirtystories|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659734; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teculek.hostzi.com (Zeus_Zbot_SpyEye)"; content:"|07|teculek|06|hostzi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659735; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timetracking02234.info ()"; content:"|11|timetracking02234|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659736; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transaharashippingline.com (Malware_Distribution)"; content:"|16|transaharashippingline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659737; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tshirtsfromhansen.com ()"; content:"|11|tshirtsfromhansen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659738; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhjqzah.dns1.us (Malware_Distribution)"; content:"|07|uhjqzah|04|dns1|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659739; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usaloaosns.com ()"; content:"|0a|usaloaosns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659740; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uskoriteliinterneta.biz ()"; content:"|13|uskoriteliinterneta|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659741; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxtubedirty.com ()"; content:"|0c|xxxtubedirty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659742; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zadpol.cu.cc ()"; content:"|06|zadpol|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659743; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logitech-steeringwheel.com (Malware_Distribution)"; content:"|16|logitech-steeringwheel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2658759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zareqah.cu.cc ()"; content:"|07|zareqah|02|cu|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659744; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zverovod.in ()"; content:"|08|zverovod|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659745; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjoptimo.ru (Malware_Distribution)"; content:"|08|jjoptimo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635700; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lampapomontage.ru (Malware_Distribution)"; content:"|0e|lampapomontage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635702; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1d14407cebdad82cc4ad7e3f91e96c65.co.cc (Malware_Distribution)"; content:"|20|1d14407cebdad82cc4ad7e3f91e96c65|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659746; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 27flu.in (Malware_Distribution)"; content:"|05|27flu|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659747; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3e9c456b00af52db360e1559b228e0f8.co.cc (Malware_Distribution)"; content:"|20|3e9c456b00af52db360e1559b228e0f8|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659748; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 46a0ab553e83e55d8df84fedfc58e661.co.cc (Malware_Distribution)"; content:"|20|46a0ab553e83e55d8df84fedfc58e661|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659749; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 46a4ee327ecbda3a2ac2b818e5934c37.co.cc (Malware_Distribution)"; content:"|20|46a4ee327ecbda3a2ac2b818e5934c37|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659750; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 923c3cbc3af7cba7fa63f485875e0a56.co.cc (Malware_Distribution)"; content:"|20|923c3cbc3af7cba7fa63f485875e0a56|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659751; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a90535f541800ca869b388a0f21235b9.co.cc (Malware_Distribution)"; content:"|20|a90535f541800ca869b388a0f21235b9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659752; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addflyer.org (Malware_Distribution)"; content:"|08|addflyer|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659753; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adera.jesais.fr (Malware_Distribution)"; content:"|05|adera|06|jesais|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659754; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adrsdyhnetrem.com (Malware_Infectors)"; content:"|0d|adrsdyhnetrem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659755; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adsly.ramp-media.com (Malware_Infectors)"; content:"|05|adsly|0a|ramp-media|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659756; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeirrwapeyn.com (Malware_Infectors)"; content:"|0b|aeirrwapeyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659757; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aigogo.info (Malware_Distribution)"; content:"|06|aigogo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659758; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analyze.us.tf (Malware_Distribution)"; content:"|07|analyze|02|us|02|tf"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659759; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-smart-protection.com (Fake_AV)"; content:"|1a|antivirus-smart-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659760; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arrowhitech.com (Malware_Distribution)"; content:"|0b|arrowhitech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659761; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-post.ru (Malware_Distribution)"; content:"|07|av-post|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659762; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6b30cdb9de396d8f6abe243ad67a94f.co.cc (Malware_Distribution)"; content:"|20|b6b30cdb9de396d8f6abe243ad67a94f|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659763; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bb3c41b0118c7bca2568cc098991e720.co.cc (Malware_Distribution)"; content:"|20|bb3c41b0118c7bca2568cc098991e720|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659764; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestnewzlx.bz.cm (Malware_Distribution)"; content:"|0a|bestnewzlx|02|bz|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659765; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigdeal777.com (Malware_Distribution)"; content:"|0a|bigdeal777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659766; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blood.of.cm (Malware_Distribution)"; content:"|05|blood|02|of|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659767; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluesky777.com (Zeus_Zbot_SpyEye)"; content:"|0a|bluesky777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659768; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brugge.osa.pl ()"; content:"|06|brugge|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659769; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup butdt.com (Malware_Distribution)"; content:"|05|butdt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659770; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bwljkx.dns1.us (Malware_Distribution)"; content:"|06|bwljkx|04|dns1|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659771; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c040459f541ea4bdae5ec5f03e21faa4.co.cc (Malware_Distribution)"; content:"|20|c040459f541ea4bdae5ec5f03e21faa4|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659772; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cananhoca.com (Malware_Distribution)"; content:"|09|cananhoca|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659773; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chadon.nl (Malware_Distribution)"; content:"|06|chadon|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659774; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup change-onmouseout.ru (Malware_Distribution)"; content:"|11|change-onmouseout|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659775; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clubnett.com (Malware_Distribution)"; content:"|08|clubnett|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659776; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colcone-marketing.ru (Malware_Distribution)"; content:"|11|colcone-marketing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659777; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d3plus.info (Malware_Infectors)"; content:"|06|d3plus|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659778; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d9d95619ae5bccc778181f80dc1b3f5a.co.cc (Malware_Distribution)"; content:"|20|d9d95619ae5bccc778181f80dc1b3f5a|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659779; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domainsrc.de ()"; content:"|09|domainsrc|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659780; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edealbuy.co.cc (Malware_Distribution)"; content:"|08|edealbuy|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659781; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edge02.net (Malware_Distribution)"; content:"|06|edge02|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659782; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eksqllpfeyaq.com (Malware_Distribution)"; content:"|0c|eksqllpfeyaq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659783; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elit3.info (Malware_Distribution)"; content:"|05|elit3|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659784; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fumumujnlz.info (Malware_Distribution)"; content:"|0a|fumumujnlz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659785; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fwsntkmsm.biz (Malware_Distribution)"; content:"|09|fwsntkmsm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659786; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerku-munka.ru ()"; content:"|0b|gerku-munka|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659787; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerlsipslokane.su (SEO_Fraud)"; content:"|0e|gerlsipslokane|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659788; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globewebsite.org (Malware_Distribution)"; content:"|0c|globewebsite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659789; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glondis.cn (Malware_Distribution)"; content:"|07|glondis|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659790; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gmqaotcz.co.tv (Malware_Distribution)"; content:"|08|gmqaotcz|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659791; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorlumclub.in (Malware_Distribution)"; content:"|0a|gorlumclub|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659792; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gyg4u.eu (Malware_Infectors)"; content:"|05|gyg4u|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659793; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huhfghf78.tk (Malware_Distribution)"; content:"|09|huhfghf78|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659794; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inet-poisk.ru ()"; content:"|0a|inet-poisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659795; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intlforeigndept.tk (Malware_Distribution)"; content:"|0f|intlforeigndept|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659796; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iooplcauen.com (Malware_Infectors)"; content:"|0a|iooplcauen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659797; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqaoeussruo.com (Malware_Infectors)"; content:"|0b|iqaoeussruo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659798; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itaieymnosho.com (Malware_Infectors)"; content:"|0c|itaieymnosho|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659799; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itkcmr.zyns.com (Malware_Distribution)"; content:"|06|itkcmr|04|zyns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659800; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itsourtimethistime.com (Malware_Infectors)"; content:"|12|itsourtimethistime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659801; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jgfznx.org (Malware_Distribution)"; content:"|06|jgfznx|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659802; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsiacorodpru.com (Malware_Infectors)"; content:"|0c|jsiacorodpru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659803; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juratozasicocyl.co.cc (Malware_Distribution)"; content:"|0f|juratozasicocyl|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659804; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup king-brian.com (SEO_Fraud)"; content:"|0a|king-brian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659805; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legcold.ru (SEO_Fraud)"; content:"|07|legcold|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659806; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup locationlook.ru ()"; content:"|0c|locationlook|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659807; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lytftswe.dns-stuff.com (Malware_Distribution)"; content:"|08|lytftswe|09|dns-stuff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659808; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m-analytics.net (Malware_Distribution)"; content:"|0b|m-analytics|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659809; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maraxovyvyjutop.co.cc (Malware_Distribution)"; content:"|0f|maraxovyvyjutop|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659810; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mipfrchesc.com (Malware_Infectors)"; content:"|0a|mipfrchesc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659811; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mitchell-i-nord-shop-po-rated-blogg.com (Malware_Infectors)"; content:"|23|mitchell-i-nord-shop-po-rated-blogg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659812; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morrarlihvcot.com (Malware_Infectors)"; content:"|0d|morrarlihvcot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659813; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mourganafilms.net (Malware_Distribution)"; content:"|0d|mourganafilms|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659814; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mssriteomi.com (Malware_Infectors)"; content:"|0a|mssriteomi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659815; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicdjproject.com (SEO_Fraud)"; content:"|0e|musicdjproject|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659816; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mxhqikb.info (Malware_Distribution)"; content:"|07|mxhqikb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659817; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myipgirl.com (Malware_Distribution)"; content:"|08|myipgirl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659818; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naseleicphcrs.com (Malware_Infectors)"; content:"|0d|naseleicphcrs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659819; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbest.us.pn (Malware_Distribution)"; content:"|07|newbest|02|us|02|pn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659820; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newfreeeye.info (Malware_Infectors)"; content:"|0a|newfreeeye|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659821; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newuyuy2012.osa.pl (Malware_Distribution)"; content:"|0b|newuyuy2012|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659822; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niska-skladka.pl (Malware_Distribution)"; content:"|0d|niska-skladka|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659823; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nocarceepcco.com (Malware_Infectors)"; content:"|0c|nocarceepcco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659824; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noseclan.ru (SEO_Fraud)"; content:"|08|noseclan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659825; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oayyurzh.esolangs.org (Malware_Infectors)"; content:"|08|oayyurzh|08|esolangs|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659826; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oglocsicchisu.com (Malware_Infectors)"; content:"|0d|oglocsicchisu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659827; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogpertopaerfczklert.com (Spyware)"; content:"|13|ogpertopaerfczklert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659828; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orfmeopeisgoa.com (Malware_Infectors)"; content:"|0d|orfmeopeisgoa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659829; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otjnznykd.org (Malware_Distribution)"; content:"|09|otjnznykd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659830; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcaoeaicte.com (Malware_Infectors)"; content:"|0a|pcaoeaicte|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659831; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcdebenyokken.net (Phishing_and_Theft)"; content:"|0d|pcdebenyokken|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659832; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcismtgniae.com (Malware_Infectors)"; content:"|0b|pcismtgniae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659833; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peirqcmmpc.com (Malware_Infectors)"; content:"|0a|peirqcmmpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659834; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalnxsoft.com (Spyware)"; content:"|0e|personalnxsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659835; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plotonk.com (Malware_Distribution)"; content:"|07|plotonk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659836; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pmrpoponae.com (Malware_Infectors)"; content:"|0a|pmrpoponae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659837; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pochemainfo.in (Malware_Distribution)"; content:"|0b|pochemainfo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659838; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proxysafe.mrkva.su (Malware_Distribution)"; content:"|09|proxysafe|05|mrkva|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659839; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puonikazg43.tk (Malware_Distribution)"; content:"|0b|puonikazg43|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659840; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puonikazg53.tk (Malware_Distribution)"; content:"|0b|puonikazg53|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659841; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puonikazg57.tk (Malware_Distribution)"; content:"|0b|puonikazg57|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659842; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puonikazg58.tk (Malware_Distribution)"; content:"|0b|puonikazg58|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659843; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puonikazg90.tk (Malware_Distribution)"; content:"|0b|puonikazg90|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659844; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puonikazg93.tk (Malware_Distribution)"; content:"|0b|puonikazg93|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659845; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pylbvai.info (Malware_Distribution)"; content:"|07|pylbvai|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659846; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup racingengines.osa.pl (Malware_Distribution)"; content:"|0d|racingengines|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659847; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rzeajc.biz (Malware_Distribution)"; content:"|06|rzeajc|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659848; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seo.86082.com (Malware_Infectors)"; content:"|03|seo|05|86082|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659849; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shangacupuncture.osa.pl ()"; content:"|10|shangacupuncture|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659850; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sidelinepros.com (Malware_Distribution)"; content:"|0c|sidelinepros|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659851; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup steeltracking.ru (Malware_Infectors)"; content:"|0d|steeltracking|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659852; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemtestnow.com (Malware_Distribution)"; content:"|0d|systemtestnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659853; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thepicturehut.net (Malware_Distribution)"; content:"|0d|thepicturehut|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659854; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tojafidofihazuv.co.cc (Malware_Distribution)"; content:"|0f|tojafidofihazuv|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659855; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trutofmymemory.su (SEO_Fraud)"; content:"|0e|trutofmymemory|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659856; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttxjp.com (Malware_Infectors)"; content:"|05|ttxjp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659857; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubeomega.org (Malware_Distribution)"; content:"|09|tubeomega|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659858; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uilpoliziafrosinone.it (Malware_Distribution)"; content:"|13|uilpoliziafrosinone|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659859; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unclesammm.com (Malware_Distribution)"; content:"|0a|unclesammm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659860; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update-java.kit.net (Malware_Infectors)"; content:"|0b|update-java|03|kit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659861; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utp7.com (Malware_Distribution)"; content:"|04|utp7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659862; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vipprojects.cn (Malware_Distribution)"; content:"|0b|vipprojects|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvesek.freetcp.com (Malware_Distribution)"; content:"|06|vvesek|07|freetcp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659863; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vzridbco.org (Malware_Distribution)"; content:"|08|vzridbco|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659864; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wefucktheworld.u2m.ru (Zeus_Zbot_SpyEye)"; content:"|0e|wefucktheworld|03|u2m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650727; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winupdates.nl (Malware_Distribution)"; content:"|0a|winupdates|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659865; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wixihiqofanecud.co.cc (Malware_Distribution)"; content:"|0f|wixihiqofanecud|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659866; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x1x2.in (Malware_Distribution)"; content:"|04|x1x2|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659867; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y5z.info (Malware_Infectors)"; content:"|03|y5z|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659868; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y9a.info (Malware_Infectors)"; content:"|03|y9a|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659869; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ykbmkniw.info (Malware_Distribution)"; content:"|08|ykbmkniw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659870; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursecurityplus.com (Malware_Distribution)"; content:"|10|yoursecurityplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659871; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zyrggbzdc.info (Malware_Distribution)"; content:"|09|zyrggbzdc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659872; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 02c20c8.netsolhost.com (Zeus_Zbot_SpyEye)"; content:"|07|02c20c8|0a|netsolhost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659873; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 02d72c3.netsolhost.com (Zeus_Zbot_SpyEye)"; content:"|07|02d72c3|0a|netsolhost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659874; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 03e09dd8757e9dddb1c4570307076a8b.co.cc (Malware_Distribution)"; content:"|20|03e09dd8757e9dddb1c4570307076a8b|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659875; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12098ca7ebbfce3a84ddb42d088902ca.co.cc (Malware_Distribution)"; content:"|20|12098ca7ebbfce3a84ddb42d088902ca|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659876; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1c2b5f29f425c26eb728cb0a355c2cc1.co.cc (Malware_Distribution)"; content:"|20|1c2b5f29f425c26eb728cb0a355c2cc1|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659877; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 30fa6fcfb6b592000d29e22dd8b0f1ac.co.cc (Malware_Distribution)"; content:"|20|30fa6fcfb6b592000d29e22dd8b0f1ac|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659878; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9d7242b1b0f4ca7c0a5b0e207d5ba6f1.co.cc (Malware_Distribution)"; content:"|20|9d7242b1b0f4ca7c0a5b0e207d5ba6f1|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659879; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-updates.net (Zeus_Zbot_SpyEye)"; content:"|0d|adobe-updates|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659880; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aoidg45ggd.com (Malware_Distribution)"; content:"|0a|aoidg45ggd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659881; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asakusa-kagetudo.com (Malware_Infectors)"; content:"|10|asakusa-kagetudo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659882; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ayjcltc.info (Malware_Distribution)"; content:"|07|ayjcltc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659883; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azfqsr.biz (Malware_Distribution)"; content:"|06|azfqsr|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659884; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmi.kurskstu.ru (Zeus_Zbot_SpyEye)"; content:"|03|bmi|08|kurskstu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659885; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillebucks.com (Malware_Distribution)"; content:"|0b|chillebucks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659886; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillecash.com (Malware_Distribution)"; content:"|0a|chillecash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659887; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillechart.com (Malware_Distribution)"; content:"|0b|chillechart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659888; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillefunds.com (Malware_Distribution)"; content:"|0b|chillefunds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659889; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillegraph.com (Malware_Distribution)"; content:"|0b|chillegraph|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659890; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chilleline.com (Malware_Distribution)"; content:"|0a|chilleline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659891; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillemap.com (Malware_Distribution)"; content:"|09|chillemap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659892; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillency.com (Malware_Distribution)"; content:"|09|chillency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659893; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillepay.com (Malware_Distribution)"; content:"|09|chillepay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659894; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chillestruct.com (Malware_Distribution)"; content:"|0c|chillestruct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659895; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chilletect.com (Malware_Distribution)"; content:"|0a|chilletect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659896; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chucjhomepage.com ()"; content:"|0d|chucjhomepage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659897; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chuckhomepage.com ()"; content:"|0d|chuckhomepage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659898; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup closteation.com (Malware_Distribution)"; content:"|0b|closteation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659899; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clostehold.com (Malware_Distribution)"; content:"|0a|clostehold|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659900; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup closteland.com (Malware_Distribution)"; content:"|0a|closteland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659901; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup closterange.com (Malware_Distribution)"; content:"|0b|closterange|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659902; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clostery.com (Malware_Distribution)"; content:"|08|clostery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659903; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clostescape.com (Malware_Distribution)"; content:"|0b|clostescape|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659904; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup closteyard.com (Malware_Distribution)"; content:"|0a|closteyard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659905; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnxuwio.info (Malware_Distribution)"; content:"|07|cnxuwio|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659906; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup culapo.org (Malware_Distribution)"; content:"|06|culapo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659907; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbmkyqng.org (Malware_Distribution)"; content:"|08|dbmkyqng|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659908; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dst-finance.com (Zeus_Zbot_SpyEye)"; content:"|0b|dst-finance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659909; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvsdfvsw.narod2.ru (Zeus_Zbot_SpyEye)"; content:"|08|dvsdfvsw|06|narod2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659910; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebuyadult.com ()"; content:"|09|ebuyadult|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659911; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecdinc.osa.pl (Malware_Distribution)"; content:"|06|ecdinc|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659912; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ee38f8445992a6d3b12c15e0b81b297a.co.cc (Malware_Distribution)"; content:"|20|ee38f8445992a6d3b12c15e0b81b297a|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659913; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ehcxiaw.info (Malware_Distribution)"; content:"|07|ehcxiaw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659914; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eifedphtosn.org (Malware_Distribution)"; content:"|0b|eifedphtosn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659915; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epratbyujux.org (Malware_Distribution)"; content:"|0b|epratbyujux|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659916; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faucetqueen.com (Malware_Distribution)"; content:"|0b|faucetqueen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659917; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fbytjyy.biz (Malware_Distribution)"; content:"|07|fbytjyy|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659918; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgubkb.biz (Malware_Distribution)"; content:"|06|fgubkb|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659919; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiisbqyco.biz (Malware_Distribution)"; content:"|09|fiisbqyco|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659920; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxffi.info (Malware_Distribution)"; content:"|06|foxffi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659921; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxnkni.org (Malware_Distribution)"; content:"|07|foxnkni|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659922; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fvxxqlcp.biz (Malware_Distribution)"; content:"|08|fvxxqlcp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659923; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gertrudaniop.in (Malware_Distribution)"; content:"|0c|gertrudaniop|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659924; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gjhyjljvty.com ()"; content:"|0a|gjhyjljvty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659925; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gloriandelorians.com (Zeus_Zbot_SpyEye)"; content:"|10|gloriandelorians|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659926; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gubunbgqito.org (Malware_Distribution)"; content:"|0b|gubunbgqito|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659927; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hakkaboat.com (Malware_Infectors)"; content:"|09|hakkaboat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659928; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hfmforum.com ()"; content:"|08|hfmforum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659929; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horoshovsebudet.ru (Malware_Distribution)"; content:"|0f|horoshovsebudet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659930; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howtodoitman.com ()"; content:"|0c|howtodoitman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659931; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ianlogattwc.org (Malware_Distribution)"; content:"|0b|ianlogattwc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659932; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igenkycu.biz (Malware_Distribution)"; content:"|08|igenkycu|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659933; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikuhkwjyd.org (Malware_Distribution)"; content:"|09|ikuhkwjyd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659934; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jamesbondajent.ru (Zeus_Zbot_SpyEye)"; content:"|0e|jamesbondajent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659935; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jdnqqo.org (Malware_Distribution)"; content:"|06|jdnqqo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659936; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetsetworldwideinc.com (Malware_Infectors)"; content:"|12|jetsetworldwideinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659937; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kgpuogtto.info (Malware_Distribution)"; content:"|09|kgpuogtto|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659938; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khhsdvsov.biz (Malware_Distribution)"; content:"|09|khhsdvsov|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659939; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kimberliah.com (Malware_Distribution)"; content:"|0a|kimberliah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659940; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legflyqvh.info (Malware_Distribution)"; content:"|09|legflyqvh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659941; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lenaason.com (Malware_Distribution)"; content:"|08|lenaason|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659942; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lqjqnqng.org (Malware_Distribution)"; content:"|08|lqjqnqng|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659943; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matoreria.com (Malware_Distribution)"; content:"|09|matoreria|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659944; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maymacngocphuong.com (Zeus_Zbot_SpyEye)"; content:"|10|maymacngocphuong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659945; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monikabestolucci.ru (Malware_Infectors)"; content:"|10|monikabestolucci|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659946; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mythorama.org (Malware_Distribution)"; content:"|09|mythorama|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659947; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namesservers.org (Zeus_Zbot_SpyEye)"; content:"|0c|namesservers|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659948; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nlyoj.biz (Malware_Distribution)"; content:"|05|nlyoj|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659949; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nmskoec.info (Malware_Distribution)"; content:"|07|nmskoec|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659950; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntvgljvty.com ()"; content:"|09|ntvgljvty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659951; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obzncjo.org (Malware_Distribution)"; content:"|07|obzncjo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659952; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinefoodbank.com (Malware_Distribution)"; content:"|0e|onlinefoodbank|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659953; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orjbhasqs.co.be (Zeus_Zbot_SpyEye)"; content:"|09|orjbhasqs|02|co|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659954; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ormfzxsiavd.info (Malware_Distribution)"; content:"|0b|ormfzxsiavd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659955; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pegging.com (Malware_Distribution)"; content:"|07|pegging|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659956; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pentaxtour.in (Malware_Infectors)"; content:"|0a|pentaxtour|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659957; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phkhekbfrem.biz (Malware_Distribution)"; content:"|0b|phkhekbfrem|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659958; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piratesmustdie.com ()"; content:"|0e|piratesmustdie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659959; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pogloro.com (Zeus_Zbot_SpyEye)"; content:"|07|pogloro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659960; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pubgortk.info (Malware_Distribution)"; content:"|08|pubgortk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659961; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qysuqonixekajoc.co.cc (Malware_Distribution)"; content:"|0f|qysuqonixekajoc|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659962; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savequboxamovuh.co.cc (Malware_Distribution)"; content:"|0f|savequboxamovuh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659963; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savingsguides.info (Malware_Distribution)"; content:"|0d|savingsguides|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659964; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savomixaxaqihah.co.cc (Malware_Distribution)"; content:"|0f|savomixaxaqihah|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659965; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sensotek-spa.com (Zeus_Zbot_SpyEye)"; content:"|0c|sensotek-spa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659966; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siseau.com ()"; content:"|06|siseau|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659967; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjrenoopoeis.com (Malware_Infectors)"; content:"|0c|sjrenoopoeis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659968; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snacepaegotsu.com (Malware_Infectors)"; content:"|0d|snacepaegotsu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659969; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snapstudios.net ()"; content:"|0b|snapstudios|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659970; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sofawivuholifin.co.cc (Malware_Distribution)"; content:"|0f|sofawivuholifin|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659971; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soineamaloocl.com (Malware_Infectors)"; content:"|0d|soineamaloocl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659972; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spiqpmomcecso.com (Malware_Infectors)"; content:"|0d|spiqpmomcecso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659973; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sppsrreimsa.com (Malware_Infectors)"; content:"|0b|sppsrreimsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659974; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup steelrode.com ()"; content:"|09|steelrode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659975; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sulusality.com (Malware_Distribution)"; content:"|0a|sulusality|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659976; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sulusate.com (Malware_Distribution)"; content:"|08|sulusate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659977; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sulusient.com (Malware_Distribution)"; content:"|09|sulusient|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659978; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sulusify.com (Malware_Distribution)"; content:"|08|sulusify|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659979; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sulusium.com (Malware_Distribution)"; content:"|08|sulusium|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659980; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sulusius.com (Malware_Distribution)"; content:"|08|sulusius|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659981; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sypuqirimatitud.co.cc (Malware_Distribution)"; content:"|0f|sypuqirimatitud|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659982; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-engineering-pc.com ()"; content:"|15|system-engineering-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659983; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telency.com (Malware_Infectors)"; content:"|07|telency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659984; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tellysquawks.com (Malware_Distribution)"; content:"|0c|tellysquawks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659985; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teorccbyaio.com (Malware_Infectors)"; content:"|0b|teorccbyaio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659986; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testeradminpanel222777.com.tw (Zeus_Zbot_SpyEye)"; content:"|16|testeradminpanel222777|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659987; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testtexttost555888.com.tw (Zeus_Zbot_SpyEye)"; content:"|12|testtexttost555888|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659988; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thpaiysmoae.com (Malware_Infectors)"; content:"|0b|thpaiysmoae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659989; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trlci.info (Malware_Distribution)"; content:"|05|trlci|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659990; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuk-tuk.com (Zeus_Zbot_SpyEye)"; content:"|07|tuk-tuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659991; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup txshzrdl.sase.si (Malware_Infectors)"; content:"|08|txshzrdl|04|sase|02|si"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659992; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ufkirankmega.net (Zeus_Zbot_SpyEye)"; content:"|0c|ufkirankmega|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659993; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup untidy.alnilin.info (Malware_Infectors)"; content:"|06|untidy|07|alnilin|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659994; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uptonxtwealth.com (Zeus_Zbot_SpyEye)"; content:"|0d|uptonxtwealth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659995; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuopurl.info (Malware_Distribution)"; content:"|07|uuopurl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659996; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valenssis.in (Malware_Infectors)"; content:"|09|valenssis|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659997; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vancouver.mindofscott.com (Malware_Infectors)"; content:"|09|vancouver|0b|mindofscott|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659998; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vesebhpo.biz (Malware_Distribution)"; content:"|08|vesebhpo|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2659999; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vfkvid2.ru (Malware_Distribution)"; content:"|07|vfkvid2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660000; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgeagck.org (Malware_Distribution)"; content:"|07|vgeagck|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660001; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup volubosudymicij.co.cc (Malware_Distribution)"; content:"|0f|volubosudymicij|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660002; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vssigma.com ()"; content:"|07|vssigma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660003; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vtzdlzs.info (Malware_Distribution)"; content:"|07|vtzdlzs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660004; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wonder-bra2011.info (Malware_Distribution)"; content:"|0e|wonder-bra2011|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660005; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woodentvtrays.buyzcheap.com (Phishing_and_Theft)"; content:"|0d|woodentvtrays|09|buyzcheap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660006; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xbncule.biz (Malware_Distribution)"; content:"|07|xbncule|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660007; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yezvvnj.info (Malware_Distribution)"; content:"|07|yezvvnj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660008; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yzgxqfe.dns1.us (Malware_Infectors)"; content:"|07|yzgxqfe|04|dns1|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660009; rev:8;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zjuyblecghf.org (Malware_Distribution)"; content:"|0b|zjuyblecghf|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2660010; rev:8;)